OpenZeppelin cairo-contracts up to 0.15.x control flow

Summaryinfo

A vulnerability categorized as problematic has been discovered in OpenZeppelin cairo-contracts up to 0.15.x. Affected is an unknown function. Such manipulation leads to control flow. This vulnerability is uniquely identified as CVE-2024-45304. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenZeppelin cairo-contracts up to 0.15.x and classified as problematic. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a control flow vulnerability. Using CWE to declare the problem leads to CWE-670. The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. Impacted is integrity. CVE summarizes:

Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vulnerability can lead to unauthorized ownership transfer, contrary to the original owner's intention of leaving the contract without an owner. It introduces a security risk where an unintended party (pending owner) can gain control of the contract after the original owner has renounced ownership. This could also be used by a malicious owner to simulate leaving a contract without an owner, to later regain ownership by previously having proposed himself as a pending owner. This issue has been addressed in release version 0.16.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is available at github.com. This vulnerability is handled as CVE-2024-45304 since 08/26/2024. The exploitation is known to be difficult. The attack may be launched remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 0.16.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch ef87d7847980e0cf83f4b7f3ff23e6590fb643ec is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• OpenZeppelin

Name

• cairo-contracts

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15

License

• open-source

Website

• Product: https://github.com/OpenZeppelin/cairo-contracts/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion