GHSA-j496-crgh-34mx: ibc-go Potential Reentrancy Using Timeout Callbacks Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-j496-crgh-34mx",
  "modified" : "2024-04-05T17:16:01Z",
  "published" : "2024-04-05T17:16:01Z",
  "aliases" : [ ],
  "summary" : "ibc-go: Potential Reentrancy using Timeout Callbacks in ibc-hooks",
  "details" : "**Name**: ASA-2024-007: Potential Reentrancy using Timeout Callbacks in ibc-hooks\n**Component**: ibc-go\n**Criticality**: Critical ([ACMv1](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md): I:Critical; L:AlmostCertain)\n**Affected versions**: < v4.6.0, < v5.4.0, < v6.3.0, < v7.4.0, < v8.2.0\n**Affected users**: Chain Builders + Maintainers\n\n# Summary\n\nThrough the deployment and subsequent use of a malicious CosmWasm contract via IBC interactions, an attacker could potentially execute the same `MsgTimeout` inside the IBC hook for the `OnTimeout` callback before the packet commitment is deleted. On chains where ibc-hooks wraps ICS-20, this vulnerability may allow for the logic of the `OnTimeout` callback of the transfer application to be recursively executed, leading to a condition that may present the opportunity for the loss of funds from the escrow account or unexpected minting of tokens.\n\n# Affected Configurations\n\nChains which satisfy all of the following requirements are considered to be impacted by this vulnerability:\n* Chain is IBC-enabled and uses a vulnerable version of ibc-go\n* Chain is CosmWasm-enabled and allows code uploads for wasm contracts by anyone, or by authorized parties (to a lesser extent)\n* Chain utilizes the ibc-hooks middleware and wraps ICS-20 transfer application\n\n# Next Steps for Impacted Chain Builders and Maintainers\n\nIt is advised to immediately upgrade to the latest patch fix version of ibc-go for your chain. If you have already applied a soft-patch through private coordination, we recommend additionally updating to the latest ibc-go version via normal software upgrade governance.\n\nIf you have not upgraded your chain yet, and you desire to mitigate exposure to this vulnerability in the meantime, it is advisable to limit code uploading for contracts to trusted parties on your chain.\n\n**If your chain only allows permissioned, access-controlled contract uploads, it is still strongly recommended to update to the latest patched ibc-go version for your chain per your normal software upgrade process.**\n\n# Preparing for future coordination\n\nIf your chain would like to be included in future coordination efforts, please ensure your chain has a prominently displayed or otherwise easily available up-to-date email address for technical security contact available. A security.md file in the root of your projects’ code repository should contain this information. Additionally, please test this security contact with an unaffiliated email to ensure it works as expected and can receive emails from outside of your domain.\n\nTo ensure that your chain is included in future impact assessments, please keep your chain information up to date in the [Cosmos Chain Registry](https://github.com/cosmos/chain-registry) with code location, network name, and public RPC and API endpoints in the details.\n\nWe recommend that all chains configure and practice the use of the [Circuit Breaker module](https://docs.cosmos.network/main/build/modules/circuit) in the Cosmos SDK, as future vulnerability notifications may require the use of this mechanism as a mitigation against exploitation.\n\n# Recognition\n\nThis issue was reported to the Cosmos Bug Bounty Program on HackerOne on 3/26/24 by Maxwell Dulin (Strikeout) at [Asymmetric Research](https://www.asymmetric.re/). If you believe you have found a bug in the Interchain Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.\n\n# Notes\n\nDue to the critical nature of this issue, both the ibc-go team and Amulet independently performed impact assessments for the ecosystem, which informed a risk-driven private patching effort that preceded this public release. This private patching effort significantly reduced the exposure of the ecosystem to this vulnerability. We appreciate the diligence and professionalism of all chains and validators involved with this effort – your ability to move quickly while maintaining confidentiality was instrumental in protecting the wider Interchain Ecosystem. \n\nIf you ever have questions about security coordination efforts, public or private, please reach out to our official communication channel at [security@interchain.io](mailto:security@interchain.io).\n\nFor more information about ibc-go, please see https://ibc.cosmos.network/main.\n\nFor more information about the Interchain Foundation’s engagement with Amulet, please see https://github.com/interchainio/security.\n\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/ibc-go/v4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.6.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/ibc-go/v5"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.4.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/ibc-go/v6"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.3.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/ibc-go/v7"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "7.4.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/ibc-go/v8"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "8.2.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/ibc-go/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 4.6.0"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/ibc-go/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 4.6.0"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/cosmos/ibc-go"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "< 4.6.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/ibc-go/security/advisories/GHSA-j496-crgh-34mx"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/ibc-go/commit/04275aa77644dec97fb91b749d963c992591b7f7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/ibc-go/commit/278fa89f192af04af32d82fd5ef41f84f82edd97"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/ibc-go/commit/5e2e9ebc2f67df324028dd36a1837ffcc8e6b0dd"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/ibc-go/commit/a0185df3953070ba5ebcb66735925449d1dbe729"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cosmos/ibc-go/commit/e78b3a2b9c9ce80a67d6b1c2b7f9abcb225cc219"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cosmos/ibc-go"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-696" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-04-05T17:16:01Z",
    "nvd_published_at" : null
  }
}