Is CVE-2022-24772 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-24772 being exploited in the wild.

How severe is CVE-2022-24772?

Low severity, with a CVSS score of 3.1, published 18 March 2022.

Which products and versions are affected?

node-forge (npm) SEMVER:introduced=0,fixed=1.3.0.

Is there a fix for CVE-2022-24772?

Yes. node-forge (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-24772 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-24772?

Check whether you run node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-24772: node-forge RSA PKCS#1 v1.5 signature forgery

CVE-2022-24772 · Severity: low · CVSS 3.1 · Published 2022-03-18

node-forge is a popular JavaScript cryptography library used to perform digital signature verification in applications. A flaw in RSA signature verification allows attackers to forge valid signatures by exploiting improper validation of padding bytes, compromising the integrity of any application that relies on this library to authenticate messages or code.

Technologies: node-forge (npm). Vendors: npm.

Quick answers

Is CVE-2022-24772 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-24772 being exploited in the wild.
How severe is CVE-2022-24772?: Low severity, with a CVSS score of 3.1, published 18 March 2022.
Which products and versions are affected?: node-forge (npm) SEMVER:introduced=0,fixed=1.3.0.
Is there a fix for CVE-2022-24772?: Yes. node-forge (npm): upgrade to 1.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-24772 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-24772?: Check whether you run node-forge (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

node-forge (npm): upgrade to 1.3.0 or later
```
npm install node-forge@1.3.0
```

Technical details

The vulnerability exists in node-forge's RSA PKCS#1 v1.5 signature verification implementation, which fails to validate trailing garbage bytes after decoding a DigestInfo ASN.1 structure (CWE-347). An attacker can exploit this by removing legitimate padding and appending arbitrary data to a crafted signature. This attack is practical when a low public exponent is used, allowing signature forgery without any authentication or user interaction required. The flaw affects all versions prior to 1.3.0, which includes the fix that properly validates the structure of signed data.

Affected products

Digital Bazaar node-forge before 1.3.0

Identifiers

CVE-2022-24772
GHSA-x4jg-mjrx-434g

Timeline

2022-03-18: disclosed
2022-03-18: patched: Fixed in version 1.3.0

References

https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.