PT-2022-20586 · Openzeppelin · Openzeppelin Contracts

Frangio · Published 2022-07-21 · Updated 2022-08-01 · CVE-2022-31172

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions 4.1.0 through 4.7.1

Description The issue concerns the SignatureChecker reverting in certain cases, which is not expected. This occurs due to an incorrect assumption about Solidity 0.8's abi.decode, specifically when a target contract does not implement EIP-1271 as expected. The contracts that may be affected are those using SignatureChecker to check signature validity and handle invalid signatures in a way other than reverting.

Recommendations For versions 4.1.0 through 4.7.1, update to version 4.7.1 to resolve the issue. As a temporary workaround, consider modifying the handling of invalid signatures in contracts that use SignatureChecker to prevent reverting. Restrict the use of SignatureChecker.isValidSignatureNow until the update is applied.

Exploit

Fix

Improper Verification of Cryptographic Signature

RCE

Weakness Enumeration

CWE-347

CWE-20

Related Identifiers

CVE-2022-31172

GHSA-4G63-C64M-25W9

Affected Products

Openzeppelin Contracts

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31172.json · Exploit
• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31172 · Security Note
• https://osv.dev/vulnerability/GHSA-4g63-c64m-25w9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31172 · Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-4g63-c64m-25w9 · Note