Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3 fix the issue.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-180 | CWE-180: Incorrect Behavior Order: Validate Before Canonicalize |
| CWE | CWE-347 | CWE-347: Improper Verification of Cryptographic Signature |
| CWE | CWE-436 | CWE-436: Interpretation Conflict |
| CWE | CWE-1289 | CWE-1289: Improper Validation of Unsafe Equivalence in Input |
Type: CWE
Description: CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Type: CWE
Description: CWE-347: Improper Verification of Cryptographic Signature
Type: CWE
Description: CWE-436: Interpretation Conflict
Type: CWE
Description: CWE-1289: Improper Validation of Unsafe Equivalence in Input
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 7.0 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L |
Version: 3.1
Base score: 7.0
Base severity: HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L