Executive brief
libp2p-secio is a JavaScript library that handles secure peer-to-peer communications in decentralized networks. The library fails to properly validate that a peer's identity (PeerId) matches the one confirmed during the cryptographic handshake, allowing an attacker to impersonate other peers on the network. An attacker can exploit this remotely without authentication to intercept, redirect, or manipulate communications between peers, potentially leading to data theft or network takeover.
Technical details
The vulnerability is a cryptographic identity verification failure (CWE-290) in the libp2p-secio library. During the SECIO protocol handshake, the library does not correctly validate that the PeerId of the DstPeer (destination peer) matches the PeerId discovered and authenticated in the crypto handshake. This allows an unauthenticated attacker to connect over the network and spoof the identity of legitimate peers. The attack has no complexity requirement and succeeds repeatably against any affected network node. The vulnerability affects all versions prior to 0.9.0; patched version 0.9.0 or later resolves the issue.
Affected products
- libp2p libp2p-secio <0.9.0
Timeline
- 2018-01-15: disclosed: Vulnerability disclosed
- 2018-01-07: patched: Fix released in version 0.9.0