A vulnerability in the evervault-go SDK prior to version 1.3.2 allows for the bypass of attestation verification, potentially leading to the trust of compromised enclave operators.

This issue involves improper verification of cryptographic signatures (CWE-347) within the SDK attestation logic. The vulnerability requires high privileges (PR:H) to influence the environment, allowing an attacker to bypass validation checks for enclave integrity.

The exploitation of this flaw could allow an attacker to deceive applications into trusting insecure or malicious enclave operators, leading to a compromise of sensitive data processed within those enclaves. Given the CVSS score of 8.7, this is a high-severity issue that directly threatens the confidentiality and integrity of payment security operations. Organizations relying on Evervault for secure enclave attestation face significant risk if their SDKs are not updated to the patched version.

Immediate Action: Update the evervault-go SDK to version 1.3.2 or later to ensure attestation documents are correctly validated before caching.

Proactive Monitoring: Review application logs for discrepancies in enclave attestation results and monitor for unauthorized attempts to serve requests from unexpected domain names.

Compensating Controls: For users unable to update immediately, modify application logic to manually validate all PCR values (0, 1, and 2) rather than relying solely on PCR8.

Public Exploit Available: Unknown.

The reliance on correct attestation is a core security component for enclave-based operations, making this vulnerability highly critical for affected systems. Administrators must prioritize the upgrade to version 1.3.2 immediately to address the underlying logic error. If an update is not immediately feasible, the recommended manual PCR validation logic should be implemented as a mandatory temporary security control.