PT-2019-9196 · Ethereum · Ethereum

Mkalinin + 1 · Published 2019-06-20 · Updated 2019-07-26 · CVE-2018-15890

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EthereumJ version 1.8.2

Description An issue was discovered in EthereumJ where there is unsafe deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. This allows arbitrary OS commands to be run on the server when a node syncs and mines a new block.

Recommendations For EthereumJ version 1.8.2, consider disabling the ois.readObject and decoder.readObject functions in mine/Ethash.java and crypto/ECKey.java respectively, until a patch is available to prevent unsafe deserialization. Restrict access to the mine/Ethash.java and crypto/ECKey.java modules to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-15890

GHSA-HF4P-JM7R-VJJJ

Affected Products

Ethereum

References · 6

• 🔥 https://github.com/frohoff/ysoserial · Exploit
• 🔥 https://github.com/ethereum/ethereumj/issues/1161 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15890 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15890 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hf4p-jm7r-vjjj · Vendor Advisory
• https://github.com/ethereum/ethereumj · Note