gluwa creditcoin on Windows untrusted search path

Summaryinfo

A vulnerability identified as problematic has been detected in gluwa creditcoin on Windows. This affects an unknown part. This manipulation causes untrusted search path. This vulnerability is tracked as CVE-2024-22410. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in gluwa creditcoin on Windows (affected version not known). Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory it is possible to replace these DLLs and execute arbitrary code. It is the view of the blockchain development team that the threat posed by a hypothetical binary planting attack is minimal and represents a low-security risk. The vulnerable DLL files are from the Windows networking subsystem, the Visual C++ runtime, and low-level cryptographic primitives. Collectively these dependencies are required for a large ecosystem of applications, ranging from enterprise-level security applications to game engines, and don’t represent a fundamental lack of security or oversight in the design and implementation of Creditcoin. The blockchain team takes the stance that running Creditcoin on Windows is officially unsupported and at best should be thought of as experimental.

The weakness was disclosed 01/18/2024 as GHSA-cx5c-xwcv-vhmq. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-22410 since 01/10/2024. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• gluwa

Name

• creditcoin

Website

• Product: https://github.com/gluwa/creditcoin/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion