Skip to content

HMAC-SHA1 signatures can bypass validation via key confusion

High
yaronn published GHSA-c27r-x354-4m68 Oct 26, 2020

Package

npm xml-crypto (npm)

Affected versions

<= 1.5.3

Patched versions

2.0.0

Description

Impact

An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.

Patches

Version 2.0.0 has the fix.

Workarounds

The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs

Credits