CyberRota Analysis
AI-GeneratedYesWiki versions 4.6.2 to 4.6.5 are vulnerable due to a flaw in the HttpSignatureService::verifySignature() method, which incorrectly handles the return value of PHP's openssl_verify() function, allowing attackers to bypass signature verification. This can lead to unauthorized processing of malicious payloads, posing a significant risk to the integrity of the application. Organizations using affected versions should prioritize upgrading to version 4.6.6 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and "false". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1) === false, the throw is skipped, and the controller proceeds to processActivity(). Any condition that makes OpenSSL's EVP_VerifyFinal() return -1 triggers the bypass. The reachable consequence is the controller silently treats a failed verification as success and processes the attacker's payload. This issue has been patched in version 4.6.6.