Executive brief
Elliptic is a widely-used cryptographic library for Node.js that implements digital signature algorithms. This vulnerability allows attackers to create multiple valid signatures for the same message by removing or appending zero bytes (EDDSA) or using improperly-encoded signatures (ECDSA), potentially bypassing signature verification checks in downstream applications and compromising authentication mechanisms.
Technical details
The vulnerability stems from missing validation checks during signature decoding in both EDDSA and ECDSA implementations. For EDDSA, the signature verification does not enforce a strict length check, permitting zero-valued bytes to be removed or appended while remaining valid. For ECDSA, the DER encoding parser does not verify that r and s have zero leading bits (per ASN.1 spec) and incorrectly permits BER-encoded sequences with leading zeros in length fields. An attacker with the ability to craft or modify signatures can exploit this to create signature collisions. No authentication or user interaction is required; the vulnerability is triggered during signature verification by any application using affected versions. The fix was merged in version 6.5.7, which adds proper length and encoding validation during signature decoding.
Affected products
- Elliptic elliptic 4.0.0 through 6.5.6
Timeline
- 2024-08-02: disclosed: Published in GitHub Advisory Database
- 2024-08-14: patched: Fix merged in version 6.5.7 (PR #317)
- 2024-07-18: other: Pull request submitted with test vectors from Wycheproof project