Executive brief
The http-signature library is a tool used to cryptographically sign HTTP requests and verify their authenticity. A vulnerability in this library allows an attacker positioned on the network to intercept and modify HTTP header names without detection, potentially changing the meaning and intent of signed requests. This could be exploited to redirect payments, alter authorization directives, or manipulate other sensitive request parameters.
Technical details
The vulnerability exists because http-signature signs only the contents (values) of HTTP headers, not their names. An attacker in a privileged network position (man-in-the-middle) can reorder or relabel headers while preserving the signature, causing the request to be interpreted differently by the server. For example, an attacker could swap the X-Payment-Source and X-Payment-Destination headers, reversing a payment direction, while the signature still validates. The attack requires network-level access but no authentication or user interaction. The vulnerability affects all versions prior to 0.10.0, which introduced proper header name validation in the signature computation.
Affected products
- Joyent http-signature <0.10.0
Timeline
- 2018-11-09: disclosed: Advisory published (CVE-2017-16005)
- 0.10.0: patched: Fix released in version 0.10.0