GitHub Advisoryadvisory · npm

GHSA-c27r-x354-4m68 xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

HIGH Published 2020-10-27 Modified 2022-08-02 Official page ↗
Ecosystem
npm
Packages
xml-crypto
Severity
High
Weaknesses
CWE-287
Reviewed
2020-10-27

Affected packages

• npm xml-crypto: < 2.0.0 → fixed in 2.0.0

Description

Impact An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation. Patches Version 2.0.0 has the fix. Workarounds The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References