GHSA-6hxq-p678-4hr2: SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
validateCertificatePath() does not verify that an attestation’s certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds (which could be user-supplied), and exits early.
This happens before the configured Apple/Google/etc trust anchor (which is concatenated to the end of the chain) is reached.
A user can therefore register a credential and have the server accept it as if it were backed by a genuine Apple / Android SafetyNet / Yubikey / etc.
References
- github.com/MasterKale/SimpleWebAuthn/commit/67a41fed3dfd96cab1dcf414f6d1792a72e06e35
- github.com/MasterKale/SimpleWebAuthn/commit/8a53d70f42bcbb7c744ef1b90e6db35bc4b26d06
- github.com/MasterKale/SimpleWebAuthn/commit/dd0d73c716a528e6645efafbd43a972b64df71f9
- github.com/MasterKale/SimpleWebAuthn/releases/tag/v13.3.2
- github.com/MasterKale/SimpleWebAuthn/security/advisories/GHSA-6hxq-p678-4hr2
- github.com/advisories/GHSA-6hxq-p678-4hr2
Code Behaviors & Features
Detect and mitigate GHSA-6hxq-p678-4hr2 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →