Executive brief
The Solid identity-token-verifier library is used to verify access tokens and cryptographic proof-of-possession (DPoP) bindings in Solid Pod servers. A verification flaw allows attackers to spoof DPoP proofs by modifying a field instead of verifying against the correct embedded public key hash, enabling attackers with a stolen access token to impersonate users and gain complete access to targeted Pods.
Technical details
This is a cryptographic verification bypass (CWE-290: Improper Verification of Cryptographic Signature) in the DPoP claim verification logic of the identity-token-verifier library. The vulnerable implementation verifies DPoP proofs against a modifiable field rather than the hash of an embedded public key, allowing attackers to forge valid DPoP claims. The vulnerability affects all versions prior to 0.5.2, which was patched on 2021-02-25. No authentication is required; an attacker with possession of any valid access token can craft a spoofed DPoP proof to rebind that token in an attack environment, gaining access to any Pod on an unpatched Solid server.
Affected products
- Solid identity-token-verifier <0.5.2
Timeline
- 2021-03-05: disclosed
- 2021-02-25: patched: Fix released in version 0.5.2