Executive brief
vp-toolkit is a library for managing verifiable credentials and presentations in blockchain-based identity systems. A vulnerability in the credential verification method allows an attacker to create a proof of ownership for credentials they do not control, potentially enabling credential forgery and unauthorized access to digital assets or services relying on these credentials.
Technical details
The verifyVerifiablePresentation() method in vp-toolkit performs cryptographic integrity checks on Verifiable Presentations but fails to validate that the credentialSubject.id DID (Decentralized Identifier) matches the actual signer of the proof. This allows an attacker to present credentials belonging to another entity as if they were the rightful holder. The vulnerability affects verifiers that rely on this method without additional validation. The fix, available in version 0.2.2, requires verifiers to explicitly match the verification method address with the credentialSubject.id using getAddressFromPubKey() from crypt-util 0.1.5 or later.
Affected products
- Rabobank vp-toolkit before 0.2.2
Timeline
- 2020-03-06: disclosed
- 2020-03-06: patched: Patch available in version 0.2.2