Skip to content

Latest commit

 

History

History
67 lines (44 loc) · 3.69 KB

cve-2022-35255.md

File metadata and controls

67 lines (44 loc) · 3.69 KB
Raw
description
Weak Randomness in WebCrypto Key Generation Vulnerability

CVE-2022-35255

Vulnerability Overview:

A vulnerability was found in NodeJS due to weak randomness in the WebCrypto keygen within the SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. Node.js made calls to EntropySource() in SecretKeyGenTraits::DoKeyGen().

However, it does not check the return value and assumes the EntropySource() always succeeds, but it can and sometimes will fail.

The above creates two issues:

  • It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail.
  • The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material

In effect, this vulnerability can be exploited by an attacker to determine the private key by analyzing the predictable output of the key generation process.

If successfully exploited, this vulnerability could result in the attacker being able to decrypt sensitive data.

Affected Versions:

Node.js 18 from Nodejs contains the vulnerability

Impact Assessment:

This vulnerability has been assigned a CVSSv3 score of 9.1 (Critical) due to its severity. The impact of the vulnerability can be crucial, as it can lead to the exposure of sensitive data to attackers.

Verifying If You Are Affected:

To determine if you are using Node.js 18 and if your usage of the platform exposes you to the vulnerability, follow these steps:

  • Identify if your application is using Node.js 18 or a package that depends on it.
  • Inspect your code to identify any usage of the WebCrypto key generation mechanism that could expose you to the vulnerability.
  • Review any input sources that could contain sensitive data to ensure that it is properly encrypted using a secure algorithm.

Remediation:

To remediate this vulnerability, we recommend upgrading to a patched version of Node.js that addresses the vulnerability. Additionally, as a temporary workaround, you may consider disabling the affected functionality until a patch is available. It is important to take action as soon as possible to ensure the security of your systems and data.

CVSS Metrics:

  • CVSSv3 Score: 9.1 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS Base Metrics

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality: High
  • Integrity: High
  • Availability: None

References: