CVE-2021-43570
📋 TL;DR
This vulnerability allows attackers to forge digital signatures on arbitrary messages by exploiting a missing non-zero check in the Stark Bank Java ECDSA library. Any application using this library for cryptographic signature verification is affected, potentially enabling authentication bypass, data tampering, or transaction fraud.
💻 Affected Systems
- Stark Bank ECDSA Java Library
📦 What is this software?
Ecdsa Java by Starkbank
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of systems relying on ECDSA signatures for authentication or transaction validation, enabling unauthorized access, financial fraud, or data manipulation.
Likely Case
Authentication bypass in applications using this library for signature verification, potentially leading to unauthorized actions or data access.
If Mitigated
Limited impact if additional authentication layers exist, but signature-based trust mechanisms remain compromised.
🎯 Exploit Status
Technical advisory includes proof-of-concept demonstrating signature forgery. Exploitation requires only the ability to submit forged signatures to vulnerable systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.1
Vendor Advisory: https://github.com/starkbank/ecdsa-java/releases/tag/v1.0.1
Restart Required: No
Instructions:
1. Update Maven/Gradle dependency to starkbank-ecdsa:1.0.1
2. Rebuild and redeploy application
3. No service restart required for library update alone
🔧 Temporary Workarounds
Implement signature validation wrapper
allAdd custom verification that checks for non-zero signature values before calling the vulnerable library function
🧯 If You Can't Patch
- Implement additional authentication layers independent of ECDSA signatures
- Monitor for anomalous signature patterns and implement rate limiting on signature verification endpoints
🔍 How to Verify
Check if Vulnerable:
Check project dependencies for starkbank-ecdsa version 1.0.0 in pom.xml, build.gradle, or dependency manifest filesCheck Version:
mvn dependency:tree | grep starkbank-ecdsa OR gradle dependencies | grep starkbank-ecdsaVerify Fix Applied:
Verify starkbank-ecdsa version 1.0.1 is present in dependencies and the verify function includes non-zero signature checks📡 Detection & Monitoring
Log Indicators:
- Multiple failed signature verifications followed by successful verification with zero-value signatures
- Unusual authentication patterns bypassing normal validation
Network Indicators:
- Repeated authentication attempts with varying signature values
- Traffic patterns suggesting signature brute-forcing
SIEM Query:
signature_verification_failure AND signature_value:0 OR authentication_bypass AND source_library:"starkbank-ecdsa"🔗 References
- https://github.com/starkbank/ecdsa-java/releases/tag/v1.0.1
- https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/
- https://github.com/starkbank/ecdsa-java/releases/tag/v1.0.1
- https://research.nccgroup.com/2021/11/08/technical-advisory-arbitrary-signature-forgery-in-stark-bank-ecdsa-libraries/
