SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor
## Summary `validateCertificatePath()` does not verify that an attestation's certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds (which could be user-supplied), and exits early. This happens before the configured Apple/Google/etc trust anchor (which is concatenated to the end of the chain) is reached. A user can therefore register a credential and have the server accept it as if it were backed by a genuine Apple / Android SafetyNet / Yubikey / etc. ## Details `packages/server/src/helpers/validateCertificatePath.ts`: The configured trust anchor is
- Auf 13.3.2 aktualisieren
Veröffentlicht Aktualisiert