CVE-2022-24772: Digitalbazaar Forge Signature Forgery

CVE-2022-24772 Overview

CVE-2022-24772 is a signature verification bypass vulnerability in Forge (also known as node-forge), a native JavaScript implementation of Transport Layer Security (TLS). Prior to version 1.3.0, the RSA PKCS#1 v1.5 signature verification code fails to check for trailing garbage bytes after decoding a DigestInfo ASN.1 structure. This improper verification allows attackers to manipulate padding bytes and inject garbage data to forge valid signatures, particularly when a low public exponent is being used.

Critical Impact

This vulnerability enables signature forgery attacks against applications using node-forge for RSA PKCS#1 v1.5 signature verification, potentially allowing attackers to bypass authentication mechanisms and forge trusted digital signatures.

Affected Products

• digitalbazaar forge versions prior to 1.3.0
• Node.js applications utilizing the node-forge package for cryptographic operations
• Web applications implementing TLS or RSA signature verification with vulnerable forge versions

Discovery Timeline

• 2022-03-18 - CVE CVE-2022-24772 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24772

Vulnerability Analysis

The vulnerability resides in the ASN.1 parsing logic within node-forge's RSA PKCS#1 v1.5 signature verification implementation. When verifying signatures, the library decodes the DigestInfo ASN.1 structure but does not validate that all bytes in the decrypted signature block have been consumed. This oversight allows trailing garbage bytes to exist after the legitimate ASN.1 structure without triggering a verification failure.

The core issue stems from incomplete parsing validation in the asn1.fromDer() function, which did not enforce that all input bytes must be parsed during signature verification operations. An attacker can exploit this by crafting signatures with manipulated padding that still produce valid-looking DigestInfo structures when decrypted.

Root Cause

The root cause is improper cryptographic signature verification (CWE-347). The ASN.1 parsing function asn1.fromDer() lacked a parseAllBytes option to ensure complete consumption of input data during parsing. Without this validation, the signature verification process accepts decrypted signature blocks containing trailing garbage data after the DigestInfo structure, violating the strict format requirements of PKCS#1 v1.5.

Attack Vector

An attacker can exploit this vulnerability over the network without authentication or user interaction. The attack is particularly effective when the target RSA key uses a low public exponent (commonly e=3). By manipulating the padding bytes in a signature and appending calculated garbage data, an attacker can construct a forged signature that passes the incomplete verification checks. This attack is a variant of the classic Bleichenbacher signature forgery attack.

The attack requires:

1. Knowledge of the message to be signed
2. Access to the target's public key with a low exponent
3. Ability to submit forged signatures to the vulnerable application

  * @param [options] object with options or boolean strict flag
  *          [strict] true to be strict when checking value lengths, false to
  *            allow truncated values (default: true).
+ *          [parseAllBytes] true to ensure all bytes are parsed
+ *            (default: true)
  *          [decodeBitStrings] true to attempt to decode the content of
  *            BIT STRINGs (not OCTET STRINGs) using strict mode. Note that
  *            without schema support to understand the data context this can
  *            erroneously decode values that happen to be valid ASN.1. This
  *            flag will be deprecated or removed as soon as schema support is
  *            available. (default: true)
  *
+ * @throws Will throw an error for various malformed input conditions.
+ *
  * @return the parsed asn1 object.
  */
 asn1.fromDer = function(bytes, options) {
   if(options === undefined) {
     options = {
       strict: true,
+      parseAllBytes: true,
       decodeBitStrings: true
     };
   }
   if(typeof options === 'boolean') {
     options = {
       strict: options,
+      parseAllBytes: true,
       decodeBitStrings: true
     };

Source: GitHub Commit

Detection Methods for CVE-2022-24772

Indicators of Compromise

• Unexpected signature verification successes for malformed or suspicious signatures
• Authentication logs showing unusual patterns of successful RSA signature-based authentication
• Application logs containing signatures with non-standard lengths or padding anomalies

Detection Strategies

• Audit package.json and package-lock.json files for node-forge versions below 1.3.0
• Implement dependency scanning using tools like npm audit, Snyk, or SentinelOne Singularity Cloud Security
• Monitor application authentication flows for anomalous signature verification patterns
• Review code repositories for direct usage of forge.pki.rsa.verify() or related signature verification functions

Monitoring Recommendations

• Enable verbose logging for all cryptographic signature verification operations
• Implement alerting for signature verification failures followed by immediate successes from the same source
• Deploy runtime application security monitoring to detect exploitation attempts
• Use SentinelOne agents to identify vulnerable node-forge package installations across your infrastructure

How to Mitigate CVE-2022-24772

Immediate Actions Required

• Upgrade node-forge to version 1.3.0 or later immediately
• Audit all applications in your environment for vulnerable node-forge versions
• Review authentication and signature verification logs for potential past exploitation
• Consider temporarily disabling RSA signature-based authentication using affected systems until patched

Patch Information

The vulnerability has been addressed in node-forge version 1.3.0. The fix introduces a parseAllBytes option to the asn1.fromDer() function, which defaults to true and ensures that all bytes are consumed during ASN.1 parsing. This prevents the acceptance of signatures with trailing garbage data.

Relevant security patches:

• Primary Fix Commit
• Additional Update Commit

For detailed information, see the GitHub Security Advisory.

Workarounds

• No known workarounds are available for this vulnerability; upgrading to version 1.3.0 or later is required
• If immediate upgrade is not possible, consider temporarily switching to alternative cryptographic libraries for signature verification
• Implement additional signature validation at the application layer as a defense-in-depth measure

# Upgrade node-forge to patched version
npm update node-forge@^1.3.0

# Verify installed version
npm list node-forge

# Audit for vulnerable packages
npm audit