mirror/ghidra
1
0
Fork 0
mirror of https://github.com/NationalSecurityAgency/ghidra.git synced 2026-09-28 17:11:11 -09:00
Code Issues Packages Projects Releases Wiki Activity

Reject null signatures in GhidraServer PKI Auth

Browse Source 
Fixes auth bypass vulnerability
This commit is contained in:
jro-calif
2026-04-08 15:59:15 +08:00
committed by Ryan Kurtz
parent 535c400d81
commit 8dfbd0bfc9
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
Ghidra/Features/GhidraServer/src/main/java/ghidra/server/security/PKIAuthenticationModule.java
View File

@@ -141,14 +141,14 @@ public class PKIAuthenticationModule implements AuthenticationModule {
DefaultTrustManagerFactory.validateClient(certChain, PKIUtils.RSA_TYPE); DefaultTrustManagerFactory.validateClient(certChain, PKIUtils.RSA_TYPE);
byte[] sigBytes = sigCb.getSignature(); byte[] sigBytes = sigCb.getSignature();
if (sigBytes != null) { if (sigBytes == null) {
throw new FailedLoginException("Client signature required");
Signature sig = Signature.getInstance(certChain[0].getSigAlgName()); }
sig.initVerify(certChain[0]); Signature sig = Signature.getInstance(certChain[0].getSigAlgName());
sig.update(token); sig.initVerify(certChain[0]);
if (!sig.verify(sigBytes)) { sig.update(token);
throw new FailedLoginException("Incorrect signature"); if (!sig.verify(sigBytes)) {
} throw new FailedLoginException("Incorrect signature");
} }
String dnUsername = String dnUsername =