Vulnerabilities in pkg:npm/@solid/identity-token-verifier
PACKAGEGHSA-xmh9-rg6f-j3mr is a MODERATE verification flaw vulnerability (CWE-290: Authentication Bypass by Spoofing) affecting @solid/identity token verifier libraries in the npm ecosystem. The issue involves verification flaw in solid identity-token-verifier. Remediation is available by upgrading affected packages to version 0.5.2.
pkg:npm/@solid/identity-token-verifier
Vulnerability advisories affecting package pkg:npm/@solid/identity-token-verifier. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-xmh9-rg6f-j3mr | - | MODERATE | Verification flaw in Solid identity-token-verifier |
GHSA-xmh9-rg6f-j3mr at a Glance
How to Fix GHSA-xmh9-rg6f-j3mr
To remediate this vulnerability, upgrade all affected @solid/identity token verifier dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @solid/identity-token-verifier@0.5.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @solid/identity-token-verifierHow to Check if You Are Affected
To determine whether your Node.js application is affected by GHSA-xmh9-rg6f-j3mr, inspect your project dependencies using npm:
npm ls @solid/identity-token-verifierAnalyze the terminal output to locate any version of @solid/identity token verifier in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.5.2), your application is affected.
Note: The npm ls @solid/identity-token-verifier command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-290: Authentication Bypass by Spoofing, where this attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. In @solid/identity token verifier, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-xmh9-rg6f-j3mr Affected @solid/identity token verifier Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@solid/identity-token-verifier
|
npm |
< 0.5.2
|
0.5.2
|
References
Frequently Asked Questions
What is GHSA-xmh9-rg6f-j3mr?
Which @solid/identity token verifier versions are affected?
What version fixes GHSA-xmh9-rg6f-j3mr?
Is @solid/identity-token-verifier affected?
What CWE is associated with GHSA-xmh9-rg6f-j3mr?
How can I check npm dependencies for GHSA-xmh9-rg6f-j3mr?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-xmh9-rg6f-j3mr",
"modified" : "2021-03-10T04:01:48Z",
"published" : "2021-03-12T22:39:01Z",
"aliases" : [ ],
"summary" : "Verification flaw in Solid identity-token-verifier",
"details" : "### Impact\n#### Severity\nAny Pod on a Solid server using a vulnerable version of the identity-token-verifier library is at risk of a spoofed Demonstration of Proof-of-Possession (DPoP) token binding. This vulnerability could give total and complete access to a targeted Pod.\n\n#### Summary\nA verification flaw in the implementation of the identity token verifier library (https://github.com/solid/identity-token-verifier) allows DPoP proofs to be spoofed. \n\nDPoP proofs are used to bind access tokens to a private key meant to be in sole possession of a specific user. Instead of verifying against the hash of an embedded public key, the library instead verifies against a field that an attacker can modify to spoof another user’s DPoP. \n\nA stolen DPoP proof, when used in the right context, therefore allows the rebinding of a DPoP-bound access token. Any attacker in possession of a targeted access token could build an attack environment to replay it on any Pod service with this vulnerability. \n\n\n### Patches\nA new version 0.5.2 of identity-token-verifier fixes the verification: https://github.com/solid/identity-token-verifier/blob/7e18d86d65ee681e8ae912b6a032a1bae3cae570/src/lib/DPoP.ts#L25-L35\n\n### Workarounds\nNone\n\n### References\n_Are there any links users can visit to find out more?_\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [identity-token-verifier](https://github.com/solid/identity-token-verifier/) repository.\n* Email: info@solidproject.org",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@solid/identity-token-verifier"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.5.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/solid/identity-token-verifier/security/advisories/GHSA-xmh9-rg6f-j3mr"
}, {
"type" : "WEB",
"url" : "https://github.com/solid/identity-token-verifier/commit/fbdeb4aa8c12694b3744cd0454acb826817d9e6c"
}, {
"type" : "WEB",
"url" : "https://github.com/solid/identity-token-verifier/releases/tag/0.5.2"
}, {
"type" : "WEB",
"url" : "https://www.npmjs.com/package/@solid/identity-token-verifier"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-290" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2021-03-10T04:01:48Z",
"nvd_published_at" : null
}
}