Executive brief
secp256k1-js is a JavaScript library implementing ECDSA cryptographic signature verification, commonly used in blockchain and cryptographic applications. The library fails to properly validate signature components (r and s values), allowing attackers to forge arbitrary valid signatures—including a signature of (0,0)—and bypass authentication or tamper with signed data without detection.
Technical details
The secp256k1-js package before version 1.1.0 implements ECDSA signature verification without checking that r and s values are non-zero (CWE-347: Improper Verification of Cryptographic Signature). Specifically, the ecverify function does not validate that sig.r ≠ 0 and sig.s ≠ 0, which are required in the ECDSA standard. An attacker can construct a malicious signature with r=0 and s=0 that will pass verification checks, enabling signature forgery on arbitrary messages. This is a classic ECDSA implementation flaw. The vulnerability affects all versions before 1.1.0; the fix was applied in version 1.1.0 by adding proper validation of signature components.
Affected products
- lionello secp256k1-js before 1.1.0
Timeline
- 2022-09-22: disclosed: Vulnerability reported in GitHub issue #11
- 2022-09-25: advisory: GHSA-q3f4-9h4p-vgr3 published
- 2022-09-27: patched: Fix available in version 1.1.0