A critical vulnerability has been discovered in the JavaScript library xml-crypto, which is used as a dependency in 402 projects and is downloaded from the npm catalog around a million times per week. The vulnerability, identified as CVE-2024-32962 and assigned the maximum hazard level of 10 out of 10, has the potential to allow attackers to create and verify fictitious documents with incorrect signatures.
The xml-crypto library is commonly used for encryption and verification of digital signatures on XML documents. The issue arises from the default configuration of the library, where it does not verify the creator of the signature but only checks the correctness of the signature itself. This means that any certificate included in the signed document’s Keyinfo XML element is trusted by the library, even if a specific certificate is specified in the settings to check digital signatures.
The vulnerability affects version 4.0.0 of XML-Crypto and was addressed without much fanfare in the January release of version 6.0.0. To exploit the vulnerability, an attacker could replace the original digital signature with one generated by their private key and insert the corresponding certificate (public key) in the Keyinfo element. This manipulated document would still be successfully verified by the library, despite the incorrect signature verification.