Low, CVSS 2.0npmPublished
SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
GHSA-6hxq-p678-4hr2
- Affected
- npm @simplewebauthn/server <= 13.3.1
- Fixed in
- 13.3.2· Vendor fix available
- Issue
- validateCertificatePath() does not verify that an attestation's certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds (which could be user-supplied), and exits early. This happens before the configured Apple/Google/etc trust anchor (which is concatenated to the end of the chain) is reached. A user can therefore register a credential and have the server accept it as if it were backed by a genuine Apple / Android SafetyNet / Yubikey / etc. Details packages/server/src/helpers/validateCertificatePath.ts: The configured trust anchor is appended to the end of the untrusted chain (line 83): The walk then verifies each cert was signed by the next, but breaks on the first self-signed cert (lines 104–116): The success condition is therefore "the certs form an internally-consistent chain ending in some self-signed cert" Rather than "the chain terminates at one of the configured trust anchors."…
Recommended action: Upgrade to 13.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.