Executive brief
msrcrypto is a cryptographic library used in JavaScript applications to perform elliptic curve cryptography operations. Versions before 1.4.1 contain a flaw in their ECC implementation that allows attackers to extract private key information and forge ECDSA signatures, potentially compromising encrypted communications and authentication mechanisms that depend on this library.
Technical details
The vulnerability exists in the Elliptic Curve Cryptography (ECC) implementation in msrcrypto versions prior to 1.4.1, classified as an incorrect calculation flaw (CWE-682). The flaw in the ECC implementation leaks information about the server's private ECC key and permits attackers to craft invalid ECDSA signatures that validate as legitimate. The vulnerability is remotely exploitable via a network vector with no authentication or user interaction required. An attacker can leverage this to compromise the confidentiality and integrity of cryptographic operations relying on this library. The fix is available in version 1.4.1 and later.
Affected products
- Microsoft msrcrypto < 1.4.1
Timeline
- 2018-09-10: disclosed: Published to GitHub Advisory Database