CVE-2024-32962
📋 TL;DR
xml-crypto versions 4.0.0 through 5.x have a critical signature validation bypass vulnerability. Attackers can forge XML signatures by replacing certificates in KeyInfo elements, allowing them to impersonate legitimate signers. This affects any Node.js application using xml-crypto for XML signature verification without additional certificate validation.
💻 Affected Systems
- xml-crypto
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass, data integrity compromise, and unauthorized access to sensitive systems by forging trusted XML signatures.
Likely Case
Attackers can impersonate legitimate users/services, sign malicious XML documents, and bypass signature-based security controls.
If Mitigated
With proper certificate validation or workarounds, signature verification functions correctly and prevents unauthorized modifications.
🎯 Exploit Status
Exploitation requires modifying XML documents and generating signatures with attacker-controlled certificates, which is straightforward for attackers with XML knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.0
Vendor Advisory: https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v
Restart Required: Yes
Instructions:
1. Update package.json to specify xml-crypto version 6.0.0 or higher. 2. Run npm update xml-crypto or yarn upgrade xml-crypto. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Certificate validation workaround
allManually validate certificates from KeyInfo against trusted certificates before accepting signature validation results.
// JavaScript implementation: const trustedCerts = [...]; const cert = signature.getCertFromKeyInfo(); if (!trustedCerts.includes(cert)) throw new Error('Untrusted certificate');
Disable KeyInfo certificate extraction
allForce xml-crypto to use explicitly configured certificates by disabling KeyInfo certificate extraction.
// Configure xml-crypto: const sig = new SignedXml(); sig.getCertFromKeyInfo = () => undefined;
🧯 If You Can't Patch
- Implement manual certificate validation by checking certificates from getCertFromKeyInfo() against a trusted certificate list.
- Configure xml-crypto with getCertFromKeyInfo set to () => undefined and explicitly set publicCert or privateKey for all signature operations.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list xml-crypto to see if version is between 4.0.0 and 5.x.Check Version:
npm list xml-crypto | grep xml-cryptoVerify Fix Applied:
Verify xml-crypto version is 6.0.0 or higher using npm list xml-crypto and test signature validation with malicious KeyInfo certificates.📡 Detection & Monitoring
Log Indicators:
- Failed signature validations with unexpected certificate changes
- XML parsing errors with modified KeyInfo elements
Network Indicators:
- Unusual XML document modifications in transit
- Multiple signature validation attempts with different certificates
SIEM Query:
source="application.log" AND "xml-crypto" AND ("signature validation" OR "certificate mismatch")🔗 References
- https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000
- https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca
- https://github.com/node-saml/xml-crypto/pull/301
- https://github.com/node-saml/xml-crypto/pull/445
- https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v
- https://security.netapp.com/advisory/ntap-20240705-0003/
- https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation
- https://github.com/node-saml/xml-crypto/commit/21201723d2ca9bc11288f62cf72552b7d659b000
- https://github.com/node-saml/xml-crypto/commit/c2b83f984049edb68ad1d7c6ad0739ec92af11ca
- https://github.com/node-saml/xml-crypto/pull/301
- https://github.com/node-saml/xml-crypto/pull/445
- https://github.com/node-saml/xml-crypto/security/advisories/GHSA-2xp3-57p7-qf4v
- https://security.netapp.com/advisory/ntap-20240705-0003/
- https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/#sec-CoreValidation
