GitHub Advisoryadvisory · npm

GHSA-6cgh-hjpw-q3gq Utils.readChallengeTx does not verify the server account signature

MEDIUM Published 2021-07-02 Modified 2021-07-02 Official page ↗
Aliases
CVE-2021-32738
Ecosystem
npm
Packages
stellar-sdk
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287, CWE-347
Reviewed
2021-07-02

Affected packages

• npm stellar-sdk: < 8.2.3 → fixed in 8.2.3

Description

The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the `serverAccountID` has signed the transaction. The function does not verify that the server has signed the transaction and has been fixed so that it does in v8.2.3. Applications that also used `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction. Applications calling `Utils.readChallengeTx` should update to v8.2.3 to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.

Related

Alias · CVE (1)

  • CVE-2021-32738 js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References