Executive brief
bsock is a WebSocket library component used by bcoin, a cryptocurrency blockchain implementation. The library uses cryptographically weak hashing algorithms (MD5 and SHA1) during WebSocket client initialization and handshake operations, which are vulnerable to collision and preimage attacks. An attacker could potentially compromise the integrity and confidentiality of WebSocket communications.
Technical details
The vulnerability is classified as Use of Weak Cryptographic Algorithms (CWE-327). The bsock library uses MD5 and SHA1 hashes in two critical locations: the Hybi.generateAccept() function uses SHA1 for WebSocket handshake key acceptance generation, and the _handshakeSignature() function uses MD5 for signature calculation during client initialization. Both MD5 and SHA1 are known to be weak and susceptible to cryptographic attacks. The vulnerable code is located in vendor/faye-websocket.js. An attacker with network access can exploit these weak algorithms to potentially forge handshakes or compromise message integrity. All versions up to 0.1.11 are affected.
Affected products
- bcoin-org bsock 0 through 0.1.11
Timeline
- 2023-11-30: disclosed: Issue #1174 opened on GitHub
- 2023-12-21: advisory: GHSA-jj93-39pf-7mcf published