Executive brief
The Stark Bank ECDSA library is used to verify cryptographic signatures in financial and security-critical applications. A flaw in the verify function allows attackers to forge valid signatures on arbitrary messages by bypassing signature validation, potentially compromising authentication, transaction integrity, and system security in any application relying on this library.
Technical details
The vulnerability is an improper verification of cryptographic signatures (CWE-347) in the verify function of starkbank-ecdsa versions prior to 1.1.3. The flaw stems from insufficient validation—the verify function fails to check that the signature is non-zero, which means an attacker can submit an all-zero or otherwise invalid signature that will be accepted as valid. This is a network-accessible vulnerability requiring no authentication or user interaction. An attacker can forge signatures on arbitrary messages, bypassing cryptographic integrity checks and potentially impersonating legitimate signers. The fix was released in version 1.1.3.
Affected products
- Stark Bank ecdsa-node before 1.1.3
Timeline
- 2021-11-10: disclosed
- 2021-11-10: patched: Fix released in version 1.1.3