Critical vulnerabilities have been identified in the Connective Signing Extension, a browser component utilized by over 2 million Belgians for accessing electronic identity (eID) cards and Maestro payment cards. These flaws, now addressed, could have enabled malicious websites to access card data, steal eID PINs, initiate fraudulent signing requests, and execute arbitrary code on Windows systems.
The Connective Signing Extension functions as an intermediary between websites, a browser extension, and a native application on the user’s computer. This native component communicates with smart-card readers to facilitate authentication and document signing. Such a setup is prevalent in Belgian banking and public-sector services, including those relying on eIDAS-qualified electronic signatures, which hold the same legal weight as handwritten signatures across the European Union.
Details of the Vulnerabilities
Researchers discovered that the extension failed to properly bind requests to their originating websites. While most commands required an activation token, this token lacked adequate origin protection. Consequently, a token issued to a legitimate site could be reused by another, potentially malicious, website. This flaw allowed attacker-controlled pages to interact with the native host and access data from connected Belgian eID or Maestro cards without the user’s knowledge.
A more severe issue was found in the PIN verification process. Malicious websites could display authentic-looking Connective PIN dialogs with attacker-controlled titles and messages, impersonating trusted banking or government services. This deception could trick users into entering their PINs, which were then sent back to the web page in an insecure manner. The transmitted PIN token included both encrypted PIN data and the information needed to decrypt it, exposing the user’s eID PIN to malicious sites after a single phishing attempt. With both the PIN and access to a connected eID card, attackers could perform unauthorized authentication or signing operations as long as the card remained connected.
Additionally, a drive-by remote code execution vulnerability was identified. Researchers found that a command executed on the native host could load a library from a path specified via a web request. An attacker could exploit this by delivering a file disguised as a harmless document, causing the Connective software to load malicious code with the current user’s privileges. Notably, this issue did not require an eID card to be connected, posing a broader security risk to endpoints.
Potential Impact and Remediation
The implications of these vulnerabilities extend beyond individual identity theft. Belgian eID workflows are integral to accessing high-value services, and compromised signing capabilities could facilitate account takeovers or fraudulent identity verifications. Researchers demonstrated an account takeover involving CSAM, though impacts on other identity platforms may vary based on additional controls.
Nitro Software Belgium, the company behind Connective and an EU-listed Qualified Trust Service Provider, addressed these issues through a series of updates. The final remediation disabled the risky library-loading capability, modified PIN-token handling so that websites receive only a reference value, and enforced origin checks for requests. The company completed these fixes 146 days after the initial report; no CVEs had been assigned at the time of reporting.
These vulnerabilities underscore the critical importance of rigorous security practices in software handling sensitive personal data. Users should ensure their software is up-to-date and remain vigilant against phishing attempts. Organizations must prioritize secure coding practices and conduct thorough security assessments to prevent such flaws from compromising user data and trust.
