CVE-2024-39696: Github.com/evmos/evmos/v18 Evmos Vulnerable To Exploit Of Vulnerability

HIGH
Advisory Identifier: GHSA-q6hg-6m9x-5g9c
Share
CVSS 8.8
CWE-863
Published
Advisory Summary

CVE-2024-39696 is a HIGH (CVSS 8.8) evmos vulnerable to exploit of vulnerability (CWE-863: Incorrect Authorization) affecting Github.com/evmos/evmos/v18 libraries in the Go ecosystem. The issue involves evmos vulnerable to exploit of smart contract account and vesting. Remediation is available by upgrading affected packages to version 19.0.0.

CVE-2024-39696 at a Glance

CVE Identifier CVE-2024-39696
GHSA Identifier GHSA-q6hg-6m9x-5g9c
Severity HIGH
CVSS v3.1 Base Score 8.8
CWE Classification CWE-863: Incorrect Authorization
Affected Product Github.com/evmos/evmos/v18
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 8.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2024-39696

To remediate this vulnerability, upgrade all affected Github.com/evmos/evmos/v18 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/evmos/evmos/v18 fixed: 19.0.0 
Upgrade github.com/evmos/evmos/v18 to 19.0.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/evmos/evmos/v18

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-39696, inspect your project dependencies for Github.com/evmos/evmos/v18:

inspect dependencies for github.com/evmos/evmos/v18

Analyze the terminal output to locate any version of Github.com/evmos/evmos/v18 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 19.0.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In Github.com/evmos/evmos/v18, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary This advisory board aims to describe two vulnerabilities found in the Evmos codebase: - _Authorization check on the fundVestingAccount_: unauthorized spend of funds. ### Details #### Authorization check on the fundVestingAccount With the current implementation, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. ### Severity Based on [ImmuneFi Severity Classification System](https://immunefisupport.zendesk.com/hc/en-us/articles/13332717597585-Severity-Classification-System) the severity was evaluated to Critical since the attack could have lead to direct loss of funds. ### Patches The issue has been patched in versions >=V19.0.0

CVE-2024-39696 Affected Github.com/evmos/evmos/v18 Versions

1 component(s)
Fixed Versions:
19.0.0
Product / Package Ecosystem Affected Versions Fixed Version
github.com/evmos/evmos/v18
golang/github.com/evmos/evmos/v18
Go
< 19.0.0
19.0.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c
NVD — CVE-2024-39696 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39696
Security Fix Commit FIX COMMIT
https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf
Github.com/evmos/evmos/v18 Source Repository REPOSITORY
https://github.com/evmos/evmos

Frequently Asked Questions

What is CVE-2024-39696?
CVE-2024-39696 is a security vulnerability in Github.com/evmos/evmos/v18 involving Evmos vulnerable to exploit of smart contract account and vesting under CWE-863: Incorrect Authorization.
Which Github.com/evmos/evmos/v18 versions are affected?
Affected versions include releases prior to 19.0.0 across affected packages: github.com/evmos/evmos/v18.
What version fixes CVE-2024-39696?
Upgrading to 19.0.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/evmos/evmos/v18 affected?
Yes, github.com/evmos/evmos/v18 is affected in releases prior to 19.0.0. Upgrade your dependency to 19.0.0 or later.
What is the CVSS score of CVE-2024-39696?
CVE-2024-39696 has a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2024-39696?
CVE-2024-39696 is classified under CWE-863: Incorrect Authorization (The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.).
How can I check Go dependencies for CVE-2024-39696?
Run the dependency tree command: 'inspect dependencies for github.com/evmos/evmos/v18'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q6hg-6m9x-5g9c",
  "modified" : "2024-07-10T14:19:51Z",
  "published" : "2024-07-10T14:19:51Z",
  "aliases" : [ "CVE-2024-39696" ],
  "summary" : "Evmos vulnerable to exploit of smart contract account and vesting",
  "details" : "### Summary\n\nThis advisory board aims to describe two vulnerabilities found in the Evmos codebase:\n\n- _Authorization check on the fundVestingAccount_: unauthorized spend of funds.\n\n### Details\n\n#### Authorization check on the fundVestingAccount\n\nWith the current implementation, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain.\n\n### Severity\nBased on [ImmuneFi Severity Classification System](https://immunefisupport.zendesk.com/hc/en-us/articles/13332717597585-Severity-Classification-System) the severity was evaluated to Critical since the attack could have lead to direct loss of funds.\n\n### Patches\nThe issue has been patched in versions >=V19.0.0",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/evmos/evmos/v18"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "19.0.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 18.0.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-39696"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/evmos/evmos"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-07-10T14:19:51Z",
    "nvd_published_at" : "2024-07-05T19:15:10Z"
  }
}