PT-2025-11289 · Unknown · Xml-Crypto

Published 2025-03-14 · Updated 2025-05-07 · CVE-2025-29775

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions xml-crypto versions prior to 6.0.1 xml-crypto versions prior to 3.2.1 xml-crypto versions prior to 2.1.6

Description The vulnerability in xml-crypto allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. This could be used to alter critical identity or access control attributes, enabling an attacker to escalate privileges or impersonate another user. The issue is related to the mechanism of checking cryptographic signatures.

Recommendations For versions prior to 6.0.1, upgrade to version 6.0.1 to receive a fix. For versions prior to 3.2.1, upgrade to version 3.2.1 to receive a fix. For versions prior to 2.1.6, upgrade to version 2.1.6 to receive a fix.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2025-02821

CVE-2025-29775

GHSA-X3M8-899R-F7C3

Affected Products

Xml-Crypto

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29775.json · Exploit
• https://bdu.fstec.ru/vul/2025-02821 · Security Note
• https://osv.dev/vulnerability/GHSA-x3m8-899r-f7c3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29775 · Security Note
• https://github.com/node-saml/xml-crypto/security/advisories/GHSA-x3m8-899r-f7c3 · Note
• https://github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed · Note
• https://github.com/node-saml/xml-crypto/releases/tag/v3.2.1 · Note
• https://github.com/node-saml/xml-crypto/releases/tag/v6.0.1 · Note
• https://github.com/node-saml/xml-crypto/releases/tag/v2.1.6 · Note
• https://github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07 · Note
• https://github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98 · Note
• https://github.com/node-saml/xml-crypto · Note
• https://twitter.com/PentesterLab/status/1904308295256641709 · Twitter Post
• https://twitter.com/threatsbank/status/1902752049650942181 · Twitter Post