PT-2021-16810 · Cosmos Network · Ethermint

Araskachoi + 2 · Published 2021-02-08 · Updated 2024-08-21 · CVE-2021-25835

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cosmos Network Ethermint versions <= v0.4.0

Description The issue is related to a cross-chain transaction replay vulnerability in the EVM module. This vulnerability is caused by the use of the same chainID and signature schemes with Ethereum for compatibility, allowing a verified signature in Ethereum to be valid in Ethermint with the same message content and chainID. This enables a "cross-chain transaction replay" attack. The vulnerability affects the github.com/cosmos/ethermint/rpc/namespaces/eth package.

Recommendations For Cosmos Network Ethermint versions <= v0.4.0, consider disabling the EVM module until a patch is available to prevent cross-chain transaction replay attacks. Restrict access to the github.com/cosmos/ethermint/rpc/namespaces/eth package to minimize the risk of exploitation. Avoid using the same chainID and signature schemes with Ethereum until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-294

CWE-295

Related Identifiers

CVE-2021-25835

GHSA-X5F3-QMWJ-4F84

GO-2022-0889

Affected Products

Ethermint

References · 9

• https://github.com/cosmos/ethermint/pull/692 · Patch
• https://osv.dev/vulnerability/GO-2022-0889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25835 · Security Note
• https://osv.dev/vulnerability/GHSA-x5f3-qmwj-4f84 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25835 · Vendor Advisory
• https://github.com/cosmos/ethermint/releases/tag/v0.4.1 · Note
• https://github.com/cosmos/ethermint/issues/687 · Note
• https://github.com/advisories/GHSA-x5f3-qmwj-4f84 · Note
• https://t.me/cibsecurity/23228 · Telegram Post