CVE-2018-1000022 Missing authorization in n/a
Attackers can steal Bitcoin from unprotected Electrum wallets by exploiting missing authorization in the JSONRPC interface via malicious JavaScript.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000022?
CVE-2018-1000022 is a medium-severity missing authorization vulnerability in n/a, published on 9 Feb 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can result in Bitcoin theft, if the user's wallet is not password protected. This attack appear to be exploitable via The victim must visit a web page with specially crafted javascript. This vulnerability appears to have been fixed in 3.0.5.
Weakness: CWE-862
Which versions are affected by CVE-2018-1000022?
It affects 1 product.
Products include Electrum Bitcoin Wallet.
How do I fix CVE-2018-1000022?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-1000022 being exploited?
There is no known exploitation of CVE-2018-1000022 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2018-1000022, GHSA-7hrg-9m3r-2cqv.