Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Summary forge.pkcs12.pkcs12FromAsn1() accepts a PKCS#12 MAC iteration count of zero (or less) from the input, and the PKCS#12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS#12/PFX file and compute a MAC that verifies with any password; PKCS#12 PBE-encrypted private keys prepared the same way decrypt with any password. Fixed in node-forge 1.4.1. Details p12.pkcs12FromAsn1() in lib/pkcs12.js reads the MAC iteration count (MacData.iterations) from the input and passes it to the PKCS#12 key derivation function pki.pbe.generatePkcs12Key() in lib/pbe.js (also exposed as forge.pkcs12.generateKey()) without checking that it is at least 1. The key derivation function (RFC 7292 Appendix B.2) runs its hash loop iter times. With an iteration count of 0 (or an empty or negative INTEGER), no hashing is done and the function returns the PKCS#12 diversifier ID byte repeated, for example 0x03 repeated 20 times for an HMAC-SHA1 MAC key. The result does not depend on the password or the salt, so anyone can compute a valid MAC over arbitrary PFX contents. The same key derivation function is…

curl https://cve.zerocrew.in/api/cve/CVE-2026-118782