CVE-2024-21669 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
Attackers can bypass verifiable credential verification by presenting invalid proofs, allowing malicious verifiers to replay presentations as their own.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21669?
CVE-2024-21669 is a critical vulnerability in hyperledger aries-cloudagent-python, published on 11 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.
Weakness: CWE-347
Which versions are affected by CVE-2024-21669?
5 open source packages ship an affected version, including aries-cloudagent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aries-cloudagent PyPI | From 0.11.0rc1 | 0.11.0 |
aries-cloudagent PyPI | From 0.11.0rc1 | 0.11.0 |
aries-cloudagent PyPI | From 0.7.0 | 0.10.5, 0.11.0 |
aries-cloudagent PyPI | From 0.7.0 | 0.10.5 |
aries-cloudagent PyPI | From 0.7.0 | 0.10.5 |
Products include Hyperledger Aries Cloud Agent.
How do I fix CVE-2024-21669?
Upgrade aries-cloudagent to a fixed version for your release line: 0.11.0 or 0.10.5.
Is CVE-2024-21669 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21669 exists.
Sources
Also known as GHSA-97x9-59rv-q5pm, PYSEC-2026-284.