From 8dfbd0bfc99ce7b1382e67bd6bb364d786d84623 Mon Sep 17 00:00:00 2001 From: jro-calif Date: Wed, 8 Apr 2026 15:59:15 +0800 Subject: [PATCH] Reject null signatures in GhidraServer PKI Auth Fixes auth bypass vulnerability --- .../server/security/PKIAuthenticationModule.java | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/Ghidra/Features/GhidraServer/src/main/java/ghidra/server/security/PKIAuthenticationModule.java b/Ghidra/Features/GhidraServer/src/main/java/ghidra/server/security/PKIAuthenticationModule.java index 3e160abb21..a751a28d32 100644 --- a/Ghidra/Features/GhidraServer/src/main/java/ghidra/server/security/PKIAuthenticationModule.java +++ b/Ghidra/Features/GhidraServer/src/main/java/ghidra/server/security/PKIAuthenticationModule.java @@ -141,14 +141,14 @@ public class PKIAuthenticationModule implements AuthenticationModule { DefaultTrustManagerFactory.validateClient(certChain, PKIUtils.RSA_TYPE); byte[] sigBytes = sigCb.getSignature(); - if (sigBytes != null) { - - Signature sig = Signature.getInstance(certChain[0].getSigAlgName()); - sig.initVerify(certChain[0]); - sig.update(token); - if (!sig.verify(sigBytes)) { - throw new FailedLoginException("Incorrect signature"); - } + if (sigBytes == null) { + throw new FailedLoginException("Client signature required"); + } + Signature sig = Signature.getInstance(certChain[0].getSigAlgName()); + sig.initVerify(certChain[0]); + sig.update(token); + if (!sig.verify(sigBytes)) { + throw new FailedLoginException("Incorrect signature"); } String dnUsername =