PT-2023-13227 · Unknown · Btcpay Server

Antoine Poinsot · Published 2023-01-31 · Updated 2023-02-08 · CVE-2022-32984

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BTCPay Server versions 1.3.0 through 1.5.3

Description The issue allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. This sensitive information, found in the HTML source code, includes the xpub of the store. Additionally, if the store is not using the internal lightning node, the credentials of a lightning node are exposed.

Recommendations For BTCPay Server versions 1.3.0 through 1.5.3, consider restricting access to the public Point of Sale app to minimize the risk of sensitive information exposure. As a temporary workaround, review the HTML source code to ensure no sensitive data is inadvertently exposed. Restrict access to the xpub of the store and lightning node credentials until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-32984

Affected Products

Btcpay Server

References · 4

• https://osv.dev/vulnerability/CVE-2022-32984 · Vendor Advisory
• https://blog.btcpayserver.org/btcpay-server-cve-2022-32984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32984 · Security Note
• https://t.me/cibsecurity/57233 · Telegram Post