Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-41037— Cleartext Signed Message Signature Spoofing in openpgpjs

Quick assessment

Affected
openpgpjs openpgpjs
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Openpgp.js是一个使用JavaScript实现的开源OpenPGP加密算法库。 OpenPGP.js存在数据伪造问题漏洞，该漏洞源于签名文本无需特殊工具即可读取。

CVSS 4.3 · Medium EPSS 0.35% · P27

Possible ATT&CK Techniques 1 AI

T1562
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-41037

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cleartext Signed Message Signature Spoofing in openpgpjs
Source: CVE Program / CVE List V5
Vulnerability Description
OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorithm used to compute the signature digest. OpenPGP.js up to v5.9.0 ignored any data preceding the "Hash: ..." texts when verifying the signature. As a result, malicious parties could add arbitrary text to a third-party Cleartext Signed Message, to lead the victim to believe that the arbitrary text was signed. A user or application is vulnerable to said attack vector if it verifies the CleartextMessage by only checking the returned `verified` property, discarding the associated `data` information, and instead _visually trusting_ the contents of the original message. Since `verificationResult.data` would always contain the actual signed data, users and apps that check this information are not vulnerable. Similarly, given a CleartextMessage object, retrieving the data using `getText()` or the `text` field returns only the contents that are considered when verifying the signature. Finally, re-armoring a CleartextMessage object (using `armor()` will also result in a "sanitised" version, with the extraneous text being removed. This issue has been addressed in version 5.10.1 (current stable version) which will reject messages when calling `openpgp.readCleartextMessage()` and in version 4.10.11 (legacy version) which will will reject messages when calling `openpgp.cleartext.readArmored()`. Users are advised to upgrade. Users unable to upgrade should check the contents of `verificationResult.data` to see what data was actually signed, rather than visually trusting the contents of the armored message.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Openpgp.js 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Openpgp.js是一个使用JavaScript实现的开源OpenPGP加密算法库。 OpenPGP.js存在数据伪造问题漏洞，该漏洞源于签名文本无需特殊工具即可读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
openpgpjs openpgpjs < 4.10.11 -

II. Public POCs for CVE-2023-41037

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-41037

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-41037 (1)

Vendor Advisories for CVE-2023-41037 (1)

IV. Related Vulnerabilities

Same product: openpgpjs
Same vendor: openpgpjs
Same weakness: CWE-347

V. Comments for CVE-2023-41037

No comments yet

Leave a comment