CryptoNote 0.8.9 RPC Server cross-site request forgery

Summaryinfo

A vulnerability described as critical has been identified in CryptoNote 0.8.9. This issue affects some unknown processing of the component RPC Server. Executing a manipulation can lead to cross-site request forgery. This vulnerability appears as CVE-2018-1000093. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability has been found in CryptoNote 0.8.9 and classified as critical. This vulnerability affects an unknown code block of the component RPC Server. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewallet RPC daemons will process any commands sent to them, resulting in remote command execution and a takeover of the cryptocurrency wallet if an attacker can trick an application such as a web browser into connecting and sending a command for example. This attack appears to be exploitable via a victim visiting a webpage hosting malicious content that trigger such behavior.

The bug was discovered 02/05/2018. The weakness was presented 03/13/2018 (Website). The advisory is shared for download at github.com. This vulnerability was named CVE-2018-1000093 since 02/21/2018. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 36 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• CryptoNote

Version

• 0.8.9

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion