8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-49365

CVE-2024-49365: tiny-secp256k1 allows for verify() bypass when running in bundled environment

tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. Buffer.isBuffer check can be bypassed, resulting in strange objects being accepted as a message, and those messages could trick verify() into returning false-positive true values. This issue has been patched in version 1.1.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-49365

CVE-2024-49365:

8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tiny-secp256k1	npm	<= 1.1.6	1.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from the use of Buffer.isBuffer for type checking within the tiny-secp256k1 library. In environments where Node.js's native Buffer object is not available and is instead polyfilled by the buffer npm package (common in browser bundlers like Webpack or in React Native), the Buffer.isBuffer check can be easily bypassed. An attacker can create a simple JSON object like {"type": "Buffer", "data": [...]} which, when parsed, can fool the Buffer.isBuffer check into returning true.

The core issue lies in the helper functions isScalar, isPoint, and isSignature, which all used this weak validation method. These functions are used by the main verify function to validate its inputs: the message hash, the public key, and the signature, respectively.

By crafting a malicious message that is a JSON-stringifyable object, an attacker can bypass the type check in isScalar. This leads the verify function to process a manipulated object instead of a byte buffer, ultimately causing it to incorrectly return true for a message and signature pair that should be invalid. This effectively allows a bypass of the cryptographic signature verification.

The patch addresses the root cause by replacing all instances of Buffer.isBuffer(x) with the more robust x instanceof Uint8Array. This ensures that the functions only accept true byte arrays, regardless of the environment, thus preventing the type confusion attack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.