PT-2022-20465 · Indy Node · Indy Node
Shakreiner
·
Published
2022-09-02
·
Updated
2022-09-13
·
CVE-2022-31020
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Indy Node versions 1.12.4 and prior
Description
The issue affects the server portion of a distributed ledger purpose-built for decentralized identity. In the affected versions, the
pool-upgrade request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The transactions are not properly sanitized, which can lead to remote code execution. As a temporary measure, endorsers should not create DIDs for untrusted users, and a vulnerable ledger should configure auth rules to prevent new DIDs from being written to the ledger until the network can be upgraded.Recommendations
For Indy Node versions 1.12.4 and prior, upgrade to version 1.12.5 or later, which has been updated to properly authenticate
pool-upgrade transactions and sanitize them to prevent remote code execution.
As a temporary workaround, consider configuring auth rules to prevent new DIDs from being written to the ledger until the network can be upgraded.
Restrict access to the pool-upgrade request handler to minimize the risk of exploitation.Exploit
Fix
Improper Authentication
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Indy Node