Executive brief
The ecdh JavaScript library for elliptic curve Diffie-Hellman key agreement fails to validate that public keys lie on the intended curve. An attacker can supply an invalid point to derive a predictable shared secret, undermining the confidentiality of encrypted communications that rely on this library. Applications using ecdh for key exchange are vulnerable to complete compromise of session encryption.
Technical details
The vulnerability is an invalid curve attack (CWE-668) in the ecdh library's deriveSharedSecret function. The function validates the format of the public key object but fails to verify that the public key point lies on the intended elliptic curve. An attacker can send a specially crafted public key (e.g., point (0,0)) that is not on the curve; the library will accept it and derive a shared secret using this invalid point, often producing a predictable or constant value. No authentication or user interaction is required—the attack is triggered remotely when the library processes an attacker-controlled public key during the ECDH handshake. The fix was released in version 0.2.0.
Affected products
- Development IL ecdh before 0.2.0
Timeline
- 2022-10-24: disclosed: Issue reported on GitHub
- 2023-02-24: advisory: GHSA published
- 2023-02-24: patched: Fix available in version 0.2.0