CVE-2024-32962

A flaw was found in xml-crypto, where the default configuration lacks authorization checks for signers, only checking the signature’s validity. This flaw allows malicious actors to pass a manipulated XML payload to instances of xml-crypto. By re-signing an XML document with a malicious private key and inserting the corresponding certificate into a element, attackers can deceive xml-crypto’s default validation checks, thus allowing spoofed signature verification and potentially facilitating the execution of malicious actions.