Executive brief
Elliptic is a widely-used cryptographic library for ECDSA digital signature operations in Node.js applications. The library fails to validate that the leading bit of ECDSA signature components (r and s values) is zero during DER decoding, allowing malleability of signatures and potential acceptance of non-canonical encodings. This could enable attackers to create alternate valid signatures for the same message, undermining signature uniqueness guarantees.
Technical details
The vulnerability is a missing validation check in ECDSA DER signature decoding (CWE-130: Improper Handling of Length Parameters). The elliptic library fails to enforce that the leading bit of the r and s components must be zero during ASN.1 DER decoding, which is required by the DER standard to ensure canonical encoding. Additionally, the library's `getLength` function allows BER-encoded length sequences with leading zeros, deviating from strict DER compliance. An attacker with network access can craft non-canonical signature encodings that the library will accept as valid, creating signature malleability. No user interaction or authentication is required. The issue was introduced in version 2.0.0 and patched in version 6.5.7 (fix merged August 2024).
Affected products
- elliptic elliptic 2.0.0 through 6.5.6
Timeline
- 2024-08-02: disclosed: Advisory published on GitHub Security Advisory and NVD
- 2024-08-14: patched: Fix merged in PR #317, released in version 6.5.7
- 2024-10-04: other: NetApp security advisory issued