PT-2021-19897 · Unknown · Js-Stellar-Sdk

Leighmcculloch · Published 2021-07-02 · Updated 2022-07-02 · CVE-2021-32738

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions js-stellar-sdk versions prior to 8.2.3

Description The Utils.readChallengeTx function in js-stellar-sdk does not verify that the server has signed the transaction, despite its documentation stating that it does. This issue affects applications that use Utils.readChallengeTx without also using Utils.verifyChallengeTxThreshold or Utils.verifyChallengeTxSigners, which do verify the server's signature. The function is used in SEP-10 Stellar Web Authentication to read and validate challenge transactions.

Recommendations For js-stellar-sdk versions prior to 8.2.3, update to version 8.2.3 to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction. As a temporary workaround, consider using Utils.verifyChallengeTxThreshold or Utils.verifyChallengeTxSigners to verify the signatures, including the server signature, on the challenge transaction.

Fix

Improper Authentication

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-287

CWE-347

Related Identifiers

CVE-2021-32738

GHSA-6CGH-HJPW-Q3GQ

Affected Products

Js-Stellar-Sdk

References · 9

• https://osv.dev/vulnerability/CVE-2021-32738 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6cgh-hjpw-q3gq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32738 · Security Note
• https://github.com/stellar/js-stellar-sdk/security/advisories/GHSA-6cgh-hjpw-q3gq · Note
• https://github.com/stellar/js-stellar-sdk/releases/tag/v8.2.3 · Note
• https://github.com/stellar/js-stellar-sdk/commit/6f0bb889c2d10b431ddd5f4a1bcdd519c80430b3 · Note
• https://t.me/cvenotify/17013 · Telegram Post
• https://t.me/cvenotify/17464 · Telegram Post
• https://t.me/cvenotify/17022 · Telegram Post