getModulesPaginated does not return the correct data

Lines of code Vulnerability details Impact In ConsoleFallbackHandler, you can call getModules to return the first 10 modules: function getModules external view returns address memory GnosisSafe safe = GnosisSafepayablemsg.sender; address memory array, = safe.getModulesPaginatedSENTINELMODULES, 10...

No proper validation of Singleton

Lines of code Vulnerability details Bug Description Operators, executors, or the Main Console account can execute transactions on behalf of a SubAccount. SubAccounts must have an enabled SafeModerator guard, which checks whether the guard and handler have not been disabled or updated, and whether...

Protocol's invariants can be broken

Lines of code Vulnerability details Impact Due to insufficient input validation to the inputs of the external function "deploySubAccount" in the SafeDeployer.sol contract,A malcious subAccount wallet can be imported,registered and then take control over other subAccounts. This can cause many...

DoS issue presented in Brahma's latest audit still has potential control flow paths that can lead to same vulnerability

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Following the "ConsoleAccount execTransaction" flow outlined via Brahma's Architecture diagram, as we can see: calling execTransaction calls checkTransaction function on...

The WalletRegistry.sol#registerWallet() function can be used to register wallet by anyone.

Lines of code Vulnerability details Impact Anyone can register wallet allowing anyone to set the iswalletmsg.sender to true for themselves allowing them to exploit other functions. Proof of Concept From the comment on the registerWallet function below, the registerWallet function Can only be call...

Lack of Input Validation on threshold and _owners

Lines of code Vulnerability details Impact Unvalidated inputs can lead to unexpected contract behaviors, including but not limited to, incorrect configurations, locked funds, or erroneous operations. In extreme cases, it could also lead to security vulnerabilities if malicious actors can exploit...

Missing payable modifier in ExecutorPlugin.executeTransaction(): Restricts Use of Native Assets (ETH) with Transactions

Lines of code Vulnerability details Impact A registered executor for a submodule cannot send ETH native assets with a transaction because the payable modifier is missing in the executeTransaction function. It's essential to address this issue to ensure full compatibility and functionality for...

ExecutorPlugin.executeTransaction() is prone to cross-chain replay attacks.

Lines of code Vulnerability details The function executeTransaction is used by executors to validate and execute transactions via a module transaction. the function takes in the input ExecutionRequest and does no validation of the msg.sender. therefore this creates an opening in which a malicious...

The same console addresses on other chains can be captured by compromised or malicious owner

Lines of code Vulnerability details Impact The same order of owners addresses lets generate the same console address on all chains. But any owner from the list can deploy console accounts on other chains with threshold parameter equals 1 and then change owners in these accounts, i.e. capture thes...

Register Wallet unprotected

Lines of code Vulnerability details Impact In the code comments, it states that: @dev Can only be called by safe deployer or the wallet itself This requires a check for either the safe deployer or the wallet. However there is no check to verify this case, therefore any address can verify their se...

ExecutorPlugin missing payable when execute the transaction

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept executeTransaction in ExecutorPlugin is meant to execute transaction but in executeTxnAsModule function executeTxnAsModuleaddress account, Types.Executable memory executable internal...

Cross site scripting

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...

CVE-2023-41896 Fake websocket server installation permits full takeover in Home Assistant Core

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...

CVE-2023-41896

CVE-2023-41896 affects Home Assistant Core and the home-assistant-js-websocket package. Cure53’s audit found that the frontend WebSocket authentication flow can be manipulated via an auth_callback=1 flag and a state parameter containing hassUrl, causing the frontend to connect to an attacker-cont...

CVE-2023-41896 Fake websocket server installation permits full takeover in Home Assistant Core

Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected authcallback=1, which is leveraged by the WebSocket authentication logic in tandem with the state parameter. The state parameter contains the hassUrl, which is...

PYSEC-2023-229

ArchiveBox is an open source self-hosted web archiving system. Any users who are using the wget extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to...

PYSEC-2023-229

ArchiveBox is an open source self-hosted web archiving system. Any users who are using the wget extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to...

CVE-2023-45133

A vulnerability was discovered in the babel package. Using certain plugins with Babel code could lead to arbitrary code execution. This issue could allow a remote attacker to craft code and then trick the user into compiling it. Mitigation Mitigation for this issue is either not available or the...

CVE-2023-45815 ArchiveBox: Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context

ArchiveBox is an open source self-hosted web archiving system. Any users who are using the wget extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to...

CVE-2023-45815

The CVE-2023-45815 entry concerns ArchiveBox, an open source self-hosted web archiving system. The provided documents describe a vulnerability tied to the wget extractor: when a logged-in admin views archived pages, malicious JavaScript served from the same host can execute in the admin session, ...