Executive brief
The IPNS library (a component for managing IPFS naming records) contained a flaw in its cryptographic key validation logic. An attacker could forge invalid records that would be accepted as authentic, potentially allowing unauthorized changes to published names and data references in IPFS systems.
Technical details
The vulnerability stems from improper public key verification in the ipns validation logic—specifically, the verify status was not being properly checked during record validation, allowing any cryptographic key to be accepted as valid. This is classified as an authentication bypass (CWE-287). The affected versions (0.1.1 and 0.1.2) fail to enforce proper signature verification, enabling an unauthenticated network attacker to create forged IPNS records. The patch (version 0.1.3) corrects the validation function to properly verify the signing key before accepting records.
Affected products
- IPFS ipns 0.1.1, 0.1.2
Timeline
- 2019-05-30: disclosed
- 2019-05-30: patched: Fixed in version 0.1.3