Do your applications use this vulnerable package?
Test your applications
Overview
elliptic is a Fast elliptic-curve cryptography in a plain javascript implementation.
Affected versions of this package are vulnerable to Cryptographic Issues. Elliptic allows ECDSA signature malleability via variations in encoding, leading \0
bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
PoC
var crypto = require('crypto')
var EC = require('elliptic').ec;
var ec = new EC('secp256k1');
var obj = require("./poc_ecdsa_secp256k1_sha256_test.json");
for (let testGroup of obj.testGroups) {
var key = ec.keyFromPublic(testGroup.key.uncompressed, 'hex');
for(let test of testGroup.tests) {
console.log("[*] Test " + test.tcId + " result: " + test.result)
msgHash = crypto.createHash('sha256').update(Buffer.from(test.msg, 'hex')).digest();
try {
result = key.verify(msgHash, Buffer.from(test.sig, 'hex'));
if (result == true) {
if (test.result == "valid" || test.result == "acceptable")
console.log("Result: PASS");
else
console.log("Result: FAIL")
}
if (result == false) {
if (test.result == "valid" || test.result == "acceptable")
console.log("Result: FAIL");
else
console.log("Result: PASS")
}
} catch (e) {
console.log("ERROR - VERIFY: " + e)
if (test.result == "valid" || test.result == "acceptable")
console.log("Result: FAIL");
else
console.log("Result: PASS")
}
}
}
Remediation
Upgrade elliptic
to version 6.5.3 or higher.
References
CVSS Score
7.7
high severity
-
Attack VectorNetwork
-
Attack ComplexityHigh
-
Privileges RequiredNone
-
User InteractionNone
-
ScopeUnchanged
-
ConfidentialityHigh
-
IntegrityHigh
-
AvailabilityLow
- Credit
- Unknown
- CVE
- CVE-2020-13822
- CWE
- CWE-310
- Snyk ID
- SNYK-JS-ELLIPTIC-571484
- Disclosed
- 05 Jun, 2020
- Published
- 17 Jun, 2020