Improper Verification of Cryptographic Signature Affecting xml-crypto package, versions >=4.0.0 <6.0.0

xml-crypto is a xml digital signature and encryption library for Node.js.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the default configuration not checking the authorization of the signer but only the validity of the signature. This oversight allows a malicious actor to re-sign an XML document and insert the certificate in a <KeyInfo /> element. Consequently, any certificate provided via a digitally signed XML document's <KeyInfo /> is trusted by default, even if the library was configured to use a specific certificate (publicCert) for signature verification purposes. An attacker can manipulate the XML document by replacing the existing signature with one generated with a malicious private key and attaching that private key's certificate to the <KeyInfo /> element.

This vulnerability in versions 4.x and 5.x can be mitigated by checking the certificate extracted via getCertFromKeyInfo against trusted certificates before accepting the results of the validation or setting xml-crypto's getCertFromKeyInfo to () => undefined, forcing xml-crypto to use an explicitly configured publicCert or privateKey for signature verification.

• GitHub Commit
• GitHub PR
• GitHub PR
• PoC
• Vulnerable Commit