sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Vulnerability

Description

In sigstore-ruby versions prior to 0.2.3, the Sigstore::Verifier#verify method calls verify_in_toto but does not capture or propagate its return value [1][3]. When the artifact digest does not match the digest in the in-toto attestation subject, verify_in_toto returns a VerificationFailure object. Because the caller ignores this return value, execution unconditionally falls through to return VerificationSuccess [3]. This is the only verification sub-check among twelve that fails to propagate a failure [3].

Exploitation

Scenario

An attacker who possesses a valid signed DSSE bundle containing an in-toto attestation for artifact A can present it as a valid attestation for a different artifact B [3]. All other verification checks—DSSE envelope signature, certificate chain, Rekor inclusion, SCTs, and policy—are independent of the artifact content and pass successfully [3]. Only the in-toto subject digest check detects the mismatch, but its result is discarded, so the bundle is accepted.

Impact

This vulnerability allows an attacker to bypass the artifact-to-attestation binding for any consumer that relies on Sigstore::Verifier#verify to validate DSSE/in-toto bundles [3]. The message_signature code path is not affected [3].

Mitigation

The issue is fixed in sigstore-ruby version 0.2.3 [1][2]. No workaround exists; consumers must upgrade to the patched version [3].