GHSA-p94w-42g3-f7h4 Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
A verifier can be tricked into accepting forged credentials because the library fails to validate that the credential issuer matches the cryptographic signer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-p94w-42g3-f7h4?
GHSA-p94w-42g3-f7h4 is a vulnerability in vp-toolkit, published on 6 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
The verifyVerifiableCredential() method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the credential.
The verifier is impacted by this vulnerability.
Patches
Patch will be available in version 0.2.2.
Workarounds
In case you trust certain issuers for certain credentials as a verifier, trust the issuer's public key from the credential.proof.verificationMethod field.
References
For more information
If you have any questions or comments about this advisory:
- Discuss in the existing issue
- Contact me
Which versions are affected by GHSA-p94w-42g3-f7h4?
2 open source packages ship an affected version, including vp-toolkit.
| Package | Affected | Fixed in |
|---|---|---|
vp-toolkit npm | All versions | 0.2.2 |
vp-toolkit npm | All versions | 0.2.2 |
How do I fix GHSA-p94w-42g3-f7h4?
Upgrade vp-toolkit to 0.2.2 or later.
Is GHSA-p94w-42g3-f7h4 being exploited?
There is no known exploitation of GHSA-p94w-42g3-f7h4 in the wild and no public exploit code.