CVE-2020-5232 Ethereum Name Service - Malicious takeover of previously owned ENS names
ENS domain owners can secretly regain ownership of transferred domains, allowing unauthorized control over name resolution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5232?
CVE-2020-5232 is a high-severity vulnerability in @ensdomains/ens, published on 30 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without the new owners consent or awareness. A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry.
Weakness: CWE-285
Which versions are affected by CVE-2020-5232?
2 open source packages ship an affected version, including @ensdomains/ens. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@ensdomains/ens npm | All versions | 0.4.0 |
@ensdomains/ens npm | All versions | 0.4.0 |
Products include Ens.domains Ethereum Name Service.
How do I fix CVE-2020-5232?
Upgrade @ensdomains/ens to 0.4.0 or later.
Is CVE-2020-5232 being exploited?
There is no known exploitation of CVE-2020-5232 in the wild and no public exploit code.
Other vulnerabilities in @ensdomains/ens
Sources
Also known as GHSA-8f9f-pc5v-9r5h.