CVE-2020-14967
📋 TL;DR
This vulnerability in jsrsasign allows attackers to modify RSA PKCS1 v1.5 ciphertexts by prepending null bytes, potentially leading to memory corruption. It affects Node.js applications using vulnerable versions of the jsrsasign package. The high CVSS score indicates critical risk for confidentiality, integrity, and availability.
💻 Affected Systems
- jsrsasign
📦 What is this software?
Jsrsasign by Jsrsasign Project
Max Data by Netapp
⚠️ Risk & Real-World Impact
Worst Case
Memory corruption leading to remote code execution, complete system compromise, or data exfiltration.
Likely Case
Denial of service through application crashes or potential information disclosure via memory corruption.
If Mitigated
Limited impact if proper input validation and memory protections are in place, though cryptographic integrity is still compromised.
🎯 Exploit Status
Exploitation requires the attacker to have ciphertexts to modify, but the modification technique is simple.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.18
Vendor Advisory: https://github.com/kjur/jsrsasign/releases/tag/8.0.18
Restart Required: Yes
Instructions:
1. Update jsrsasign to version 8.0.18 or later using npm: npm update jsrsasign
2. Restart your Node.js application
3. Verify the update with: npm list jsrsasign
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation to reject ciphertexts with leading null bytes before decryption.
// JavaScript example: if (ciphertext.startsWith('\0')) throw new Error('Invalid ciphertext');
🧯 If You Can't Patch
- Disable RSA PKCS1 v1.5 decryption in affected applications if possible.
- Implement network segmentation to isolate vulnerable systems from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list jsrsasign | grep jsrsasignCheck Version:
npm list jsrsasignVerify Fix Applied:
Confirm installed version is 8.0.18 or higher: npm list jsrsasign📡 Detection & Monitoring
Log Indicators:
- Application crashes, unexpected memory errors, or decryption failures in logs
Network Indicators:
- Unusual patterns of encrypted traffic with modified ciphertexts
SIEM Query:
source="application_logs" AND ("jsrsasign" OR "RSA decryption error")🔗 References
- https://github.com/kjur/jsrsasign/issues/439
- https://github.com/kjur/jsrsasign/releases/tag/8.0.17
- https://github.com/kjur/jsrsasign/releases/tag/8.0.18
- https://kjur.github.io/jsrsasign/
- https://security.netapp.com/advisory/ntap-20200724-0001/
- https://www.npmjs.com/package/jsrsasign
- https://github.com/kjur/jsrsasign/issues/439
- https://github.com/kjur/jsrsasign/releases/tag/8.0.17
- https://github.com/kjur/jsrsasign/releases/tag/8.0.18
- https://kjur.github.io/jsrsasign/
- https://security.netapp.com/advisory/ntap-20200724-0001/
- https://www.npmjs.com/package/jsrsasign
