PT-2023-22770 · Npm · @Web3-React/Metamask+4

Andrewmohawk · Publicado 2023-04-17 · Atualizado 2023-05-01 · CVE-2023-30543

Positive Technologies (AI Summary)

CVSS v3.1

5.2

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions @web3-react versions prior to the updated npm artifacts

Description The chainId may be outdated if the user changes chains as part of the connection flow, causing the value of chainId returned by useWeb3React() to be incorrect. This can lead to incorrect data derived from chainId, such as a wrapped token contract address in a swapping application, potentially causing users to send funds to the incorrect address.

Recommendations For @web3-react versions prior to the updated npm artifacts, upgrade to at least:

• @web3-react/coinbase-wallet@^8.0.35-beta.0
• @web3-react/eip1193@^8.0.27-beta.0
• @web3-react/metamask@^8.0.30-beta.0
• @web3-react/walletconnect@^8.0.37-beta.0 As a temporary workaround, consider verifying the chainId value before deriving any critical data from it.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2023-30543

GHSA-8PF3-6FGR-3G3G

Produtos afetados

@Web3-React

@Web3-React/Coinbase-Wallet

@Web3-React/Eip1193

@Web3-React/Metamask

@Web3-React/Walletconnect

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30543.json · Exploit
• https://github.com/Uniswap/web3-react/pull/749 · Correção
• https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g · Aviso do Fabricante
• https://github.com/Uniswap/web3-react · Nota
• https://osv.dev/vulnerability/CVE-2023-30543 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-30543 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8pf3-6fgr-3g3g · Aviso do Fabricante
• https://t.me/cvenotify/49482 · Publicação no Telegram
• https://t.me/cvenotify/48469 · Publicação no Telegram