PT-2024-28634 · Evmos · Evmos

Gatom22 · Published 2024-07-05 · Updated 2024-07-10 · CVE-2024-39696

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Evmos versions prior to 19.0.0

Description The issue allows a user to create a vesting account with a 3rd party account as funder without its permission. This is possible because the authorization checked in the code is for the contract.CallerAddress, but the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission, potentially draining all accounts in the chain.

Recommendations For versions prior to 19.0.0, update to version 19.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vesting account creation feature to minimize the risk of exploitation. Avoid using the funder address parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-39696

GHSA-Q6HG-6M9X-5G9C

GO-2024-2974

Affected Products

Evmos

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39696.json · Exploit
• https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf · Patch
• https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39696 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39696 · Security Note
• https://osv.dev/vulnerability/GO-2024-2974 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q6hg-6m9x-5g9c · Vendor Advisory
• https://github.com/evmos/evmos · Note
• https://t.me/pentestingnews/48977 · Telegram Post
• https://twitter.com/CVEnew/status/1809304152272695410 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1809329984206500238 · Twitter Post
• https://twitter.com/fridaysecurity/status/1810852550922399840 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1810852108297720288 · Twitter Post
• https://twitter.com/cracbot/status/1810192197905690971 · Twitter Post
• https://t.me/cvenotify/85286 · Telegram Post