Junglewise Threat Intelligence

vp-toolkit proof of ownership validation bypass

Severity: info · Published 2020-03-06

Vendors: npm.

Executive brief

vp-toolkit is a library for managing verifiable credentials and presentations in blockchain-based identity systems. A vulnerability in the credential verification method allows an attacker to create a proof of ownership for credentials they do not control, potentially enabling credential forgery and unauthorized access to digital assets or services relying on these credentials.

Technical details

The verifyVerifiablePresentation() method in vp-toolkit performs cryptographic integrity checks on Verifiable Presentations but fails to validate that the credentialSubject.id DID (Decentralized Identifier) matches the actual signer of the proof. This allows an attacker to present credentials belonging to another entity as if they were the rightful holder. The vulnerability affects verifiers that rely on this method without additional validation. The fix, available in version 0.2.2, requires verifiers to explicitly match the verification method address with the credentialSubject.id using getAddressFromPubKey() from crypt-util 0.1.5 or later.

Affected products

  • Rabobank vp-toolkit before 0.2.2

Timeline

  • 2020-03-06: disclosed
  • 2020-03-06: patched: Patch available in version 0.2.2

References

Related threats