PT-2022-20636 · Electrum · Electrum

Frank Davidson · Published 2022-06-17 · Updated 2022-06-28 · CVE-2022-31246

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Electrum versions prior to 4.2.2

Description The issue allows a file:// URL in the r parameter of a payment request, which can be exploited in various ways depending on the operating system. On Windows, this can lead to the capture of credentials over SMB. On Linux and UNIX, it can cause a denial of service by specifying the /dev/zero filename, potentially disrupting system operations.

Recommendations For Electrum versions prior to 4.2.2, update to version 4.2.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the r parameter in payment requests to prevent potential exploitation.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2022-31246

GHSA-4FH4-HX35-R355

Affected Products

Electrum

References · 5

• https://osv.dev/vulnerability/CVE-2022-31246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31246 · Security Note
• https://github.com/spesmilo/electrum/security/advisories/GHSA-4fh4-hx35-r355 · Note
• https://twitter.com/ElectrumWallet/status/1534540879905665028 · Note
• https://t.me/cibsecurity/44739 · Telegram Post