Vulnerability Report: Unsanitized signedPeerRecord in Identify (Python)

[scacaca]

Summary

The Python Identify implementation accepts signedPeerRecord without validation.
An attacker can forward a valid signed PeerRecord from another peer, causing address poisoning / identity spoofing.

This is equivalent to the Go libp2p Identify vulnerability
, which has already been patched.

Expected behavior

identify: reject signed peer records on peer ID mismatch
and make ConsumeEnvelope harder to misuse

Actual behavior

accept signed peer records on peer ID mismatch

Relevant log output

Possible Solution

Add strict validation for signedPeerRecord in parse_identify_response to prevent identity spoofing and peerstore poisoning.
There is a similar fix logic

Environment

Would you like to work on fixing this bug ?

Yes

[lla-dane]

Hello @scacaca: Actually the peer-id cross-check logic is not directly present in the signed-peer records module. What is happening is, the signed-peer-record trasfer is currently integrated in kad-dht, pubsub and identify protocols.

In kad-dht and pubsub protocols, when we receive a signed-peer-record in the protobuf schema, we call this function maybe_consume_signed_record to consume the received record:

• Kad-dht: https://github.com/lla-dane/py-libp2p/blob/77b06a2a9b175054bea8e915154ae25daf7c335a/libp2p/kad_dht/utils.py#L23C1-L91C1

• Pubsub: https://github.com/lla-dane/py-libp2p/blob/77b06a2a9b175054bea8e915154ae25daf7c335a/libp2p/pubsub/utils.py#L15C1-L54C16

We are cross-checking the message sender peer-id with the record's peer id in this line:

if not record.peer_id == peer_id:
	return False

But your observation is right for the identify protocol, I forgot to cross-check the sender's peer-id with record's peer-id here:

https://github.com/lla-dane/py-libp2p/blob/77b06a2a9b175054bea8e915154ae25daf7c335a/libp2p/identity/identify_push/identify_push.py#L144C5-L156C14

So you can open a PR, for fixing this vulnerability for the identify protocol.
@seetadev

[scacaca]

Thank you. I fix it like this