Lucene search

[email protected]CVE-2021-32738

HistoryJul 02, 2021 - 7:15 p.m.

CVE-2021-32738

2021-07-0219:15:08

CWE-347

CWE-287

[email protected]

web.nvd.nist.gov

js-stellar-sdk

cve-2021-32738

security vulnerability

javascript library

sep-10

stellar web authentication

server signature

update required

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

19.5%

JSON

js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the serverAccountID has signed the transaction. In js-stellar-sdk before version 8.2.3, the function does not verify that the server has signed the transaction. Applications that also used Utils.verifyChallengeTxThreshold or Utils.verifyChallengeTxSigners to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction. Applications calling Utils.readChallengeTx should update to version 8.2.3, the first version with a patch for this vulnerability, to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.

Affected configurations

Vulners

NVD

Node

stellarjs-stellar-sdkRange<8.2.3

VendorProductVersionCPE
stellarjs\-stellar\-sdk*cpe:2.3:a:stellar:js\-stellar\-sdk:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
stellar	js\-stellar\-sdk	*	cpe:2.3:a:stellar:js\-stellar\-sdk::::::::

CNA Affected

[
  {
    "product": "js-stellar-sdk",
    "vendor": "stellar",
    "versions": [
      {
        "status": "affected",
        "version": "< 8.2.3"
      }
    ]
  }
]