CVE-2021-32738 Utils.readChallengeTx does not verify the server account signature
The Stellar JavaScript SDK fails to verify server signatures in challenge transactions, allowing attackers to bypass authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32738?
CVE-2021-32738 is a medium-severity authentication bypass vulnerability in js-stellar-sdk, published on 2 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the `serverAccountID` has signed the transaction. In js-stellar-sdk before version 8.2.3, the function does not verify that the server has signed the transaction. Applications that also used `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction. Applications calling `Utils.readChallengeTx` should update to version 8.2.3, the first version with a patch for this vulnerability, to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.
Which versions are affected by CVE-2021-32738?
2 open source packages ship an affected version, including stellar-sdk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
stellar-sdk npm | All versions | 8.2.3 |
stellar-sdk npm | All versions | 8.2.3 |
Products include Stellar Js-Stellar-Sdk.
How do I fix CVE-2021-32738?
Upgrade stellar-sdk to 8.2.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-32738 being exploited?
There is no known exploitation of CVE-2021-32738 in the wild and no public exploit code.
Sources
Also known as GHSA-6cgh-hjpw-q3gq.