GHSA-97x9-59rv-q5pm

Suggest an improvement
Source
https://github.com/advisories/GHSA-97x9-59rv-q5pm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-97x9-59rv-q5pm/GHSA-97x9-59rv-q5pm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-97x9-59rv-q5pm
Aliases
Related
Published
2024-01-09T20:31:55Z
Modified
2024-02-16T08:21:59.597067Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L CVSS Calculator
Summary
Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
Details

Impact

When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation document.proof was not factored into the final verified value (true/false) on the presentation record. Below is an example result from verifying a JSON-LD Presentation where there is an error noted in the processing (mismatched challenge), but the overall result is incorrectly "verified": true:

{
  "verified": true,
  "presentation_result": {
    "verified": false,
    "document": {
      "@context": [
        "https://www.w3.org/2018/credentials/v1"
      ],
      "type": [
        "VerifiablePresentation"
      ],
      "verifiableCredential": [
        {
          "@context": [
            "https://www.w3.org/2018/credentials/v1",
            "https://w3id.org/citizenship/v1"
          ],
          "type": [
            "VerifiableCredential",
            "PermanentResident"
          ],
          "issuer": "did:sov:EzcfrVw7Tveho5NjrmDWnd",
          "issuanceDate": "2023-11-18",
          "credentialSubject": {
            "type": [
              "PermanentResident"
            ],
            "id": "did:key:z6MkrpbudRMUpTWSdqFcG2ytbYu2QQfgGFUf8GJpShR8Gy7C",
            "givenName": "Bob",
            "familyName": "Builder",
            "gender": "Male",
            "birthCountry": "Bahamas",
            "birthDate": "1958-07-17"
          },
          "proof": {
            "type": "Ed25519Signature2018",
            "proofPurpose": "assertionMethod",
            "verificationMethod": "did:sov:EzcfrVw7Tveho5NjrmDWnd#key-1",
            "created": "2023-11-18T21:39:56.988853+00:00",
            "jws": "eyJhbGciOiAiRWREU0EiLCAiYjY0IjogZmFsc2UsICJjcml0IjogWyJiNjQiXX0..eKdLMhKJkiVNzTKOEv14KyAFJnk8QX5MqXPmRE5OjQvwRNkeXk1lQRovhDhXKw154OrSqLHgfSNwBd3xfwuDCA"
          }
        }
      ],
      "proof": {
        "type": "Ed25519Signature2018",
        "proofPurpose": "authentication",
        "verificationMethod": "did:key:z6MkrpbudRMUpTWSdqFcG2ytbYu2QQfgGFUf8GJpShR8Gy7C#z6MkrpbudRMUpTWSdqFcG2ytbYu2QQfgGFUf8GJpShR8Gy7C",
        "created": "2023-11-18T21:39:59.188276+00:00",
        "challenge": "ce0956d4-206d-4b69-a087-52bbb9ddaf1d",
        "jws": "eyJhbGciOiAiRWREU0EiLCAiYjY0IjogZmFsc2UsICJjcml0IjogWyJiNjQiXX0..4ciLzT3oF-Ch9nngGVgI_fBNIo_RPPXzRuFXjMx4AdwVNM4ioeB3TNDbHsF7fPXANznkZR0bHceyvMN3-CUSAw"
      }
    },
    "results": [
      {
        "verified": false,
        "proof": {
          "@context": [
            "https://www.w3.org/2018/credentials/v1"
          ],
          "type": "Ed25519Signature2018",
          "proofPurpose": "authentication",
          "verificationMethod": "did:key:z6MkrpbudRMUpTWSdqFcG2ytbYu2QQfgGFUf8GJpShR8Gy7C#z6MkrpbudRMUpTWSdqFcG2ytbYu2QQfgGFUf8GJpShR8Gy7C",
          "created": "2023-11-18T21:39:59.188276+00:00",
          "challenge": "ce0956d4-206d-4b69-a087-52bbb9ddaf1d",
          "jws": "eyJhbGciOiAiRWREU0EiLCAiYjY0IjogZmFsc2UsICJjcml0IjogWyJiNjQiXX0..4ciLzT3oF-Ch9nngGVgI_fBNIo_RPPXzRuFXjMx4AdwVNM4ioeB3TNDbHsF7fPXANznkZR0bHceyvMN3-CUSAw"
        },
        "error": "The challenge is not as expected; challenge=ce0956d4-206d-4b69-a087-52bbb9ddaf1d, expected=328daf6e-f1f5-475a-944e-6446e7b3a969",
        "purpose_result": {
          "valid": false,
          "error": "The challenge is not as expected; challenge=ce0956d4-206d-4b69-a087-52bbb9ddaf1d, expected=328daf6e-f1f5-475a-944e-6446e7b3a969"
        }
      }
    ],
    "errors": [
      "The challenge is not as expected; challenge=ce0956d4-206d-4b69-a087-52bbb9ddaf1d, expected=328daf6e-f1f5-475a-944e-6446e7b3a969"
    ]
  },
  "credential_results": [
    {
      "verified": true,
      "document": {
        "@context": [
          "https://www.w3.org/2018/credentials/v1",
          "https://w3id.org/citizenship/v1"
        ],
        "type": [
          "VerifiableCredential",
          "PermanentResident"
        ],
        "issuer": "did:sov:EzcfrVw7Tveho5NjrmDWnd",
        "issuanceDate": "2023-11-18",
        "credentialSubject": {
          "type": [
            "PermanentResident"
          ],
          "id": "did:key:z6MkrpbudRMUpTWSdqFcG2ytbYu2QQfgGFUf8GJpShR8Gy7C",
          "givenName": "Bob",
          "familyName": "Builder",
          "gender": "Male",
          "birthCountry": "Bahamas",
          "birthDate": "1958-07-17"
        },
        "proof": {
          "type": "Ed25519Signature2018",
          "proofPurpose": "assertionMethod",
          "verificationMethod": "did:sov:EzcfrVw7Tveho5NjrmDWnd#key-1",
          "created": "2023-11-18T21:39:56.988853+00:00",
          "jws": "eyJhbGciOiAiRWREU0EiLCAiYjY0IjogZmFsc2UsICJjcml0IjogWyJiNjQiXX0..eKdLMhKJkiVNzTKOEv14KyAFJnk8QX5MqXPmRE5OjQvwRNkeXk1lQRovhDhXKw154OrSqLHgfSNwBd3xfwuDCA"
        }
      },
      "results": [
        {
          "verified": true,
          "proof": {
            "@context": [
              "https://www.w3.org/2018/credentials/v1",
              "https://w3id.org/citizenship/v1"
            ],
            "type": "Ed25519Signature2018",
            "proofPurpose": "assertionMethod",
            "verificationMethod": "did:sov:EzcfrVw7Tveho5NjrmDWnd#key-1",
            "created": "2023-11-18T21:39:56.988853+00:00",
            "jws": "eyJhbGciOiAiRWREU0EiLCAiYjY0IjogZmFsc2UsICJjcml0IjogWyJiNjQiXX0..eKdLMhKJkiVNzTKOEv14KyAFJnk8QX5MqXPmRE5OjQvwRNkeXk1lQRovhDhXKw154OrSqLHgfSNwBd3xfwuDCA"
          },
          "purpose_result": {
            "valid": true,
            "controller": {
              "@context": "https://w3id.org/security/v2",
              "id": "did:sov:EzcfrVw7Tveho5NjrmDWnd",
              "assertionMethod": [
                "did:sov:EzcfrVw7Tveho5NjrmDWnd#key-1"
              ],
              "authentication": [
                {
                  "id": "did:sov:EzcfrVw7Tveho5NjrmDWnd#key-1",
                  "type": "Ed25519VerificationKey2018",
                  "controller": "did:sov:EzcfrVw7Tveho5NjrmDWnd",
                  "publicKeyBase58": "8dMkWKZxsK7vS8sR4XgS7gWvRawPp5TMYVFvnU2RyXqo"
                }
              ],
              "verificationMethod": "did:sov:EzcfrVw7Tveho5NjrmDWnd#key-1",
              "https://www.w3.org/ns/did#service": {
                "id": "did:sov:EzcfrVw7Tveho5NjrmDWnd#did-communication",
                "type": "did-communication",
                "https://www.w3.org/ns/did#serviceEndpoint": {
                  "id": "http://alice:3000"
                }
              }
            }
          }
        }
      ]
    }
  ],
  "errors": [
    "The challenge is not as expected; challenge=ce0956d4-206d-4b69-a087-52bbb9ddaf1d, expected=328daf6e-f1f5-475a-944e-6446e7b3a969"
  ]
}

The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own.

This vulnerability has been present since the first implementation of support for JSON-LD W3C Verifiable Credential Data Model presentations, in Aries Cloud Agent Python release in 0.7.0.

All ACA-Py Users depending on W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs are impacted by this vulnerability.

Patches

This issue has been patched in version 0.10.5 and fixed in 0.11.0.

Workarounds

There is no workaround other upgrading to a patched/fixed version of ACA-Py.

Database specific 
{
    "nvd_published_at": "2024-01-11T06:15:44Z",
    "cwe_ids": [
        "CWE-347"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-09T20:31:55Z"
}
References

Affected packages

PyPI / aries-cloudagent

Package

Name
aries-cloudagent
View open source insights on deps.dev
Purl
pkg:pypi/aries-cloudagent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.7.0
Fixed
0.10.5

Affected versions

0.*

0.7.0
0.7.1rc0
0.7.1
0.7.2rc0
0.7.2
0.7.3rc0
0.7.3
0.7.4rc0
0.7.4rc1
0.7.4rc2
0.7.4rc3
0.7.4rc4
0.7.4rc5
0.7.4
0.7.5rc0
0.7.5rc1
0.7.5
0.8.0rc0
0.8.0
0.8.1rc0
0.8.1rc1
0.8.1rc2
0.8.1
0.8.2rc0
0.8.2rc1
0.8.2rc2
0.8.2
0.9.0rc0
0.9.0
0.10.0rc0
0.10.0rc1
0.10.0rc2
0.10.0
0.10.1
0.10.2rc0
0.10.2
0.10.3
0.10.4

PyPI / aries-cloudagent

Package

Name
aries-cloudagent
View open source insights on deps.dev
Purl
pkg:pypi/aries-cloudagent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.11.0rc1
Fixed
0.11.0

Affected versions

0.*

0.11.0rc1
0.11.0rc2