Critical · published June 16, 2021
🚨 A signature bug in tEnvoy makes it easy to pass off false credentials as valid – like letting anyone into a VIP club just because they wear a matching tie! 🔥 Imagine a restaurant where the bouncer lets anyone in who claims to have a reservation that matches the name on the guest list, without checking if they actually made one. That’s what’s happening here with the `verifyWithMessage` method – it’s just accepting claims without verification! An attacker could craft a bogus signature that appears to validate against a message, effectively bypassing security measures. This could lead to unauthorized access and actions being taken under the guise of legitimacy, putting sensitive data and operations at serious risk.
Imagine a restaurant where the bouncer lets anyone in who claims to have a reservation that matches the name on the guest list, without checking if they actually made one. That’s what’s happening here with the `verifyWithMessage` method – it’s just accepting claims without verification! In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` improperly validates signatures, always returning true for any matching SHA-512 hash, regardless of signature authenticity.
An attacker could craft a bogus signature that appears to validate against a message, effectively bypassing security measures. This could lead to unauthorized access and actions being taken under the guise of legitimacy, putting sensitive data and operations at serious risk. Upgrade to version 7.0.3 immediately to patch this vulnerability. As a workaround, modify `tenvoy.js` in the `verifyWithMessage` method to ensure that the return statement calls `this.verify` and ends with `.verified`. This will ensure that only legitimate signatures pass the check. You've got this! Following these steps will keep your application safe and sound. 🛡️