Improper Verification of Cryptographic Signature in `node-forge`

The core of this vulnerability lies in the flawed validation of the DigestInfo component within RSA PKCS#1 v1.5 signatures. node-forge fails to rigorously check the ASN.1 structure, permitting signatures with invalid structures to be accepted as valid if the digest itself matches. This means an attacker can craft a malicious signature with a subtly altered ASN.1 structure but a valid hash, effectively bypassing the verification process. The potential impact is significant, as it could allow attackers to impersonate legitimate entities or tamper with digitally signed data without detection. For example, an attacker could forge a signature on a software update, tricking a user's system into installing malware. The blast radius depends on the applications using node-forge and the sensitivity of the data being protected by these signatures.

1. आरक्षित2022-02-10
2. प्रकाशित2022-03-18
3. संशोधित2025-04-23
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2022-24773 is to upgrade to node-forge version 1.3.0 or later, which includes the necessary fixes for ASN.1 structure validation. If upgrading immediately is not feasible, consider implementing stricter input validation on the signatures being processed. While not a complete solution, this can add a layer of defense. Review your application's code to identify all instances where node-forge is used for signature verification and ensure that the updated version is deployed as soon as possible. After upgrading, confirm the fix by attempting to verify a known-malformed signature – it should now be rejected.

अंतिम अपडेट

1.4.0हाल ही में