Vulnerability-Lookup

CVE-2024-39696 (GCVE-0-2024-39696)

Vulnerability from cvelistv5 – Published: 2024-07-05 18:49 – Updated: 2024-08-02 04:26

Title

Evmos vulnerable to exploit of smart contract account and vesting

Summary

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/evmos/evmos/security/advisorie…	x_refsource_CONFIRM
	https://github.com/evmos/evmos/commit/0a620e17661…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	evmos	evmos	Affected: < 19.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "evmos",
            "vendor": "evmos",
            "versions": [
              {
                "lessThan": "19.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39696",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-07T13:57:09.223321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T16:17:06.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:15.993Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c"
          },
          {
            "name": "https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "evmos",
          "vendor": "evmos",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 19.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-05T18:49:22.153Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c"
        },
        {
          "name": "https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf"
        }
      ],
      "source": {
        "advisory": "GHSA-q6hg-6m9x-5g9c",
        "discovery": "UNKNOWN"
      },
      "title": "Evmos vulnerable to exploit of smart contract account and vesting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-39696",
    "datePublished": "2024-07-05T18:49:22.153Z",
    "dateReserved": "2024-06-27T18:44:13.037Z",
    "dateUpdated": "2024-08-02T04:26:15.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c\", \"name\": \"https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf\", \"name\": \"https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:15.993Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39696\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-07T13:57:09.223321Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:*\"], \"vendor\": \"evmos\", \"product\": \"evmos\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"19.0.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-07T13:56:35.872Z\"}}], \"cna\": {\"title\": \"Evmos vulnerable to exploit of smart contract account and vesting\", \"source\": {\"advisory\": \"GHSA-q6hg-6m9x-5g9c\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"evmos\", \"product\": \"evmos\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 19.0.0\"}]}], \"references\": [{\"url\": \"https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c\", \"name\": \"https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf\", \"name\": \"https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863: Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-07-05T18:49:22.153Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39696\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T04:26:15.993Z\", \"dateReserved\": \"2024-06-27T18:44:13.037Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-07-05T18:49:22.153Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-39696

Vulnerability from fkie_nvd - Published: 2024-07-05 19:15 - Updated: 2025-03-07 16:46

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf	Patch
security-advisories@github.com	https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c	Vendor Advisory

Impacted products

	Vendor	Product	Version
	evmos	evmos	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:evmos:evmos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FB8E6A7-2AFB-4E0F-811C-C64344CDFA91",
              "versionEndExcluding": "19.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0."
    },
    {
      "lang": "es",
      "value": "Evmos es una cadena descentralizada de m\u00e1quinas virtuales Ethereum en Cosmos Network. Antes de la versi\u00f3n 19.0.0, un usuario puede crear una cuenta de adquisici\u00f3n de derechos con una cuenta de un tercero (EOA o contrato) como financiador. Luego, este usuario puede crear una autorizaci\u00f3n para el contrato.CallerAddress, esta es la autorizaci\u00f3n marcada en el c\u00f3digo. Pero los fondos se toman de la direcci\u00f3n del financiador proporcionada en el mensaje. En consecuencia, el usuario puede depositar fondos en una cuenta de adquisici\u00f3n de derechos con una cuenta de terceros sin su permiso. La direcci\u00f3n del financiador puede ser cualquier direcci\u00f3n, por lo que esta vulnerabilidad se puede utilizar para vaciar todas las cuentas de la cadena. El problema se solucion\u00f3 en la versi\u00f3n 19.0.0."
    }
  ],
  "id": "CVE-2024-39696",
  "lastModified": "2025-03-07T16:46:59.827",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-07-05T19:15:10.673",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-Q6HG-6M9X-5G9C

Vulnerability from github – Published: 2024-07-10 14:19 – Updated: 2024-07-10 14:19

Summary

Evmos vulnerable to exploit of smart contract account and vesting

Details

Summary

This advisory board aims to describe two vulnerabilities found in the Evmos codebase:

Authorization check on the fundVestingAccount: unauthorized spend of funds.

Details

Authorization check on the fundVestingAccount

With the current implementation, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain.

Severity

Based on ImmuneFi Severity Classification System the severity was evaluated to Critical since the attack could have lead to direct loss of funds.

Patches

The issue has been patched in versions >=V19.0.0

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 18.0.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/evmos/evmos/v18"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "19.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39696"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-10T14:19:51Z",
    "nvd_published_at": "2024-07-05T19:15:10Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThis advisory board aims to describe two vulnerabilities found in the Evmos codebase:\n\n- _Authorization check on the fundVestingAccount_: unauthorized spend of funds.\n\n### Details\n\n#### Authorization check on the fundVestingAccount\n\nWith the current implementation, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain.\n\n### Severity\nBased on [ImmuneFi Severity Classification System](https://immunefisupport.zendesk.com/hc/en-us/articles/13332717597585-Severity-Classification-System) the severity was evaluated to Critical since the attack could have lead to direct loss of funds.\n\n### Patches\nThe issue has been patched in versions \u003e=V19.0.0",
  "id": "GHSA-q6hg-6m9x-5g9c",
  "modified": "2024-07-10T14:19:51Z",
  "published": "2024-07-10T14:19:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/evmos/evmos/security/advisories/GHSA-q6hg-6m9x-5g9c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39696"
    },
    {
      "type": "WEB",
      "url": "https://github.com/evmos/evmos/commit/0a620e176617a835ac697eea494afea09185dfaf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/evmos/evmos"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Evmos vulnerable to exploit of smart contract account and vesting"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-39696 (GCVE-0-2024-39696)

FKIE_CVE-2024-39696

GHSA-Q6HG-6M9X-5G9C

Summary

Details

Authorization check on the fundVestingAccount

Severity

Patches

Tags

Sightings

Nomenclature