Failure to validate signature during handshake in @chainsafe/libp2p-noise

Vulnerability

The @chainsafe/libp2p-noise TypeScript implementation of the Noise protocol used in libp2p does not correctly validate signatures during the handshake process in versions before 4.1.2 and 5.0.3 [1][3]. This flaw resides in the signature verification step of the handshake, allowing an attacker to inject or alter signed payloads without detection.

Exploitation

An attacker who can perform a man-in-the-middle attack on the communication channel can exploit this by presenting invalid or forged signatures that the handshake code improperly accepts [3]. No additional authentication or user interaction is required beyond network positioning to intercept traffic between two legitimate peers.

Impact

A successful exploit allows the attacker to pose as any other peer in the network [3]. This impersonation can cause the legitimate target peer to be blamed for misbehavior and subsequently banned by other nodes, disrupting the peer-to-peer connectivity and potentially leading to denial of service for the targeted peer [1][3].

Mitigation

Users should upgrade to version 4.1.2 or 5.0.3, which contain the fix [1][3]. The fix is available in the GitHub pull request #130 and includes corrected signature validation logic [1]. No known workarounds exist for unpatched versions [3].