node-forge (Forge) versions before 1.4.1 accept a certificate as a CA when it contains a forged extension under the deprecated OIDs 2.5.29.10 or 2.5.29.13, placed before the genuine basicConstraints extension. An attacker who holds a certificate from a CA trusted by the application, where that CA copies extensions from certificate signing requests, can issue certificates for arbitrary names and impersonate servers or clients. Exploitation is complex and depends on such a trusted CA, and a public proof of concept exists.
Digital Bazaar · node-forge
Forge (node-forge) is a JavaScript implementation of TLS. A remote, unauthenticated peer can send a TLS record of another content type in the middle of a fragmented handshake message, which causes an uncaught TypeError in process(). This terminates the affected connection or the Node.js process hosting it, so the impact is limited to availability (CVSS 7.5, A:H). Exposure is highest for Node.js services that use forge's TLS code and accept connections from untrusted peers.
Digital Bazaar · Forge (node-forge)
Forge (node-forge) is a JavaScript implementation of TLS. Before version 1.4.1, the TLS record processing in forge.tls.createConnection() handled each received record recursively, so a single input chunk with thousands of small records (for example heartbeat records) exhausts the JavaScript call stack. The attack needs no authentication and can be started by any peer that connects to a forge TLS server or to a server a forge TLS client connects to. In Node.js applications that call process() from a socket data handler, the uncaught exception terminates the process and drops the connections it serves.
Digital Bazaar · Forge (node-forge)
Forge (node-forge) is a JavaScript library implementing TLS and cryptography. Versions before 1.4.1 accept a PKCS#12 MAC or password-based encryption iteration count of zero, which makes the derived key a constant independent of the password and salt. An attacker can modify PKCS#12/PFX files or encrypted private keys and forge a valid MAC without knowing the password, so an application may accept an attacker's certificate and key. The attack requires no authentication, but only applies if the application parses such files from untrusted sources; confidentiality is not affected.
Digital Bazaar · Forge (node-forge)
Forge (node-forge) is a JavaScript implementation of Transport Layer Security. Its PEM parser uses regular expressions whose processing time grows polynomially with malformed input, so an unauthenticated attacker can block the Node.js event loop with a long crafted message. The issue affects applications that pass untrusted PEM data to node-forge, for example services that accept uploaded certificates or keys.
Digital Bazaar · Forge (node-forge)
