PT-2023-19311 · Openzeppelin · Openzeppelin Contracts For Cairo

Martriay · Published 2023-02-02 · Updated 2023-02-13 · CVE-2023-23940

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts for Cairo versions prior to 0.6.1

Description The issue is related to the is valid eth signature function missing a call to finalize keccak after calling verify eth signature. This allows a malicious sequencer to bypass signature validation and impersonate accounts using the EthAccount preset. The risk of exploitation is reduced since only StarkWare currently runs both a prover and a sequencer.

Recommendations For versions prior to 0.6.1, update to version 0.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the is valid eth signature function until the update is applied. Additionally, be cautious of potential malicious sequencer activity and monitor for any unusual account impersonation attempts.

Exploit

Fix

Insufficient Verification of Data Authenticity

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-345

CWE-347

Related Identifiers

CVE-2023-23940

GHSA-626Q-V9J4-MCP4

PYSEC-2023-39

Affected Products

Openzeppelin Contracts For Cairo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23940.json · Exploit
• https://github.com/OpenZeppelin/cairo-contracts/pull/542/commits/6d4cb750478fca2fd916f73297632f899aca9299 · Patch
• https://osv.dev/vulnerability/GHSA-626q-v9j4-mcp4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23940 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-39 · Vendor Advisory
• https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-626q-v9j4-mcp4 · Note
• https://github.com/OpenZeppelin/cairo-contracts · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/openzeppelin-cairo-contracts/PYSEC-2023-39.yaml · Note
• https://t.me/cibsecurity/57501 · Telegram Post