PT-2021-16809 · Cosmos+1 · Cosmos Network Ethermint+1

Summerpro

·

Published

2021-02-08

·

Updated

2024-08-21

·

CVE-2021-25834

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Cosmos Network Ethermint versions <= v0.4.0
Description The issue is related to a transaction replay vulnerability in the EVM module. If a victim sends a very large nonce transaction, an attacker can replay the transaction through the application. This vulnerability affects specific Go packages, including github.com/cosmos/ethermint/rpc/namespaces/eth. The vulnerability can also be described as an authentication bypass by capture-replay.
Recommendations For Cosmos Network Ethermint versions <= v0.4.0, consider disabling the EVM module or restricting its use to minimize the risk of exploitation until a patch is available. Restrict access to the github.com/cosmos/ethermint/rpc/namespaces/eth package to prevent potential abuse. Avoid using very large nonce transactions in the affected application to reduce the risk of transaction replay attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-294CWE-287

Related Identifiers

CVE-2021-25834
GHSA-93P5-8FQW-WJX3
GO-2022-0813

Affected Products

Cosmos Network Ethermint
Github.Com/Cosmos/Ethermint/Rpc/Namespaces/Eth