-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-65ch-62r8-g69g, is an integer overflow within the node-forge library's ASN.1 parsing functionality. The core of the issue is located in the asn1.derToOid function in lib/asn1.js. The vulnerability stems from the use of JavaScript's bitwise left-shift operator (<<), which operates on 32-bit signed integers. When decoding an ASN.1 Object Identifier (OID), a large value for an OID arc could be crafted by an attacker. During decoding, the value = value << 7; operation would cause this large number to overflow the 32-bit limit and wrap around, resulting in a completely different and smaller OID value. This allows an attacker to create a malicious certificate with a specially crafted large OID that the node-forge library would misinterpret as a standard, trusted OID, potentially bypassing security checks.
The patch, found in commit 3e0c35ace169cfca529a3e547a7848dc7bf57fdb, rectifies this by replacing the bitwise shift with multiplication (value = value * 128), which does not force a 32-bit conversion and can handle larger numbers up to Number.MAX_SAFE_INTEGER. Additionally, a check was added to asn1.oidToDer to prevent the encoding of overly large OIDs in the first place. Therefore, asn1.derToOid is the primary vulnerable function where the exploitation would occur, and asn1.oidToDer is a related function modified as a preventative measure.
asn1.derToOidlib/asn1.js
asn1.oidToDerlib/asn1.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| node-forge | npm | < 1.3.2 | 1.3.2 |