CVE-2024-21669

• CVSS 8.8
• CWE-347 Improper Verification of Cryptographic Signature
• Information Leakage
• Remote

Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.

CVE

CVE-2024-21669

CWE

CWE-347 Improper Verification of Cryptographic Signature

CVSS base score

8.8

Published

2024-01-11

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Information Leakage

Subcategory

Insecure Handling of Sensitive Data

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Hyperledger Aries Cloud Agent Python (ACA-Py) to version 0.10.5 or later

def verify_presentation(presentation):
    proof_verified = verify_proof(presentation['proof'])

    presentation_valid = validate_presentation(presentation)

    presentation['verified'] = presentation_valid

    return presentation['verified']

def verify_proof(proof):
    return True

def validate_presentation(presentation):
    return True

def verify_presentation(presentation):
    if not isinstance(presentation, dict):
        return False

    proof = presentation.get('proof')
    if not proof or not verify_proof(proof):
        return False

    if not validate_presentation(presentation):
        return False

    return True

def verify_proof(proof):
    if not isinstance(proof, dict):
        return False
    return 'signature' in proof and isinstance(proof['signature'], str)

def validate_presentation(presentation):
    required_keys = {'id', 'holder', 'proof'}
    return required_keys.issubset(presentation.keys())

@misc{vaitp:cve202421669,
  title        = {{}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21669},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21669/}}
}