PT-2024-19401 · Unknown · Creditcoin

Dobermann-Pinscher · Published 2024-01-17 · Updated 2024-01-26 · CVE-2024-22410

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Creditcoin (affected versions not specified)

Description The issue concerns the Windows binary of the Creditcoin node, which loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory, it is possible to replace these DLLs and execute arbitrary code. The vulnerable DLL files are from the Windows networking subsystem, the Visual C++ runtime, and low-level cryptographic primitives. The blockchain development team views the threat posed by a hypothetical binary planting attack as minimal and represents a low-security risk. The team also states that running Creditcoin on Windows is officially unsupported and should be thought of as experimental.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2024-22410

GHSA-CX5C-XWCV-VHMQ

Affected Products

Creditcoin

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22410.json · Exploit
• https://github.com/gluwa/creditcoin/security/advisories/GHSA-cx5c-xwcv-vhmq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22410 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22410 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1747766552668106986 · Twitter Post
• https://owasp.org/www-community/attacks/Binary_planting · Note
• https://t.me/cvenotify/67843 · Telegram Post
• https://twitter.com/CVEnew/status/1747720132045246658 · Twitter Post