PT-2024-9247 · Solana · @Solana/Web3.Js

Luscher · Published 2024-12-02 · Updated 2025-04-19 · CVE-2024-54134

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions 1.95.6 through 1.95.7

Description: A publish-access account was compromised for @solana/web3.js, a JavaScript library commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages, enabling them to steal private key material and drain funds from dapps that handle private keys directly. The issue does not affect non-custodial wallets, as they generally do not expose private keys during transactions. It is a problem with a specific JavaScript client library, affecting projects that directly handle private keys and updated within a specific time window.

Recommendations: For versions 1.95.6 and 1.95.7, upgrade to version 1.95.8. Developers that suspect they might be compromised should rotate any suspect authority keys, including multisigs, program authorities, server keypairs, and so on.

Exploit

Fix

Information Disclosure

RCE

Weakness Enumeration

CWE-200

CWE-506

Related Identifiers

BDU:2024-10935

CVE-2024-54134

GHSA-JCXM-7WVP-G6P5

Affected Products

@Solana/Web3.Js

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54134.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-54134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54134 · Security Note
• https://bdu.fstec.ru/vul/2024-10935 · Security Note
• https://osv.dev/vulnerability/GHSA-jcxm-7wvp-g6p5 · Vendor Advisory
• https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5 · Note
• https://github.com/solana-labs/solana-web3.js · Note
• https://twitter.com/CveFindCom/status/1864332812578410958 · Twitter Post
• https://xakep.ru/2024/12/05/solana-web3-js · Note
• https://twitter.com/CVEnew/status/1864332285677334666 · Twitter Post
• https://advisories.gitlab.com/pkg/npm/@solana/web3.js/CVE-2024-54134 · Note
• https://twitter.com/Eth1calHackrZ/status/1866052668596375657 · Twitter Post
• https://github.com/advisories/GHSA-2mhj-xmf4-pr8m · Note
• https://twitter.com/zbraiterman/status/1913612901434196183 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1864476123612037482 · Twitter Post