PT-2022-20568 · Openzeppelin · Openzeppelin Contracts For Cairo

Martriay · Published 2022-07-15 · Updated 2022-07-22 · CVE-2022-31153

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts for Cairo version 0.2.0

Description The issue affects all accounts in the v0.2.0 release of OpenZeppelin Contracts for Cairo that are not whitelisted on StarkNet mainnet, rendering them unusable on live networks. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. The bug has been patched in v0.2.1.

Recommendations For version 0.2.0, update to version 0.2.1 to resolve the issue.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-664

Related Identifiers

CVE-2022-31153

GHSA-8MJR-JR5H-Q2XR

Affected Products

Openzeppelin Contracts For Cairo

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31153.json · Exploit
• 🔥 https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203 · Exploit
• 🔥 https://github.com/OpenZeppelin/cairo-contracts/issues/386 · Exploit
• https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9 · Patch
• https://github.com/OpenZeppelin/cairo-contracts/pull/387 · Patch
• https://osv.dev/vulnerability/CVE-2022-31153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31153 · Security Note
• https://osv.dev/vulnerability/GHSA-8mjr-jr5h-q2xr · Vendor Advisory
• https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1 · Note
• https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr · Note
• https://github.com/OpenZeppelin/cairo-contracts · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/openzeppelin-cairo-contracts-test/PYSEC-2022-43143.yaml · Note
• https://t.me/cvenotify/33170 · Telegram Post
• https://t.me/cibsecurity/46370 · Telegram Post