CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts
Attackers can hijack uninitialized UUPS implementation contracts to gain control, affecting developers using OpenZeppelin Contracts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41264?
CVE-2021-41264 is a critical missing authorization vulnerability in openzeppelin-contracts, published on 12 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).
Weakness: CWE-665
Which versions are affected by CVE-2021-41264?
4 open source packages ship an affected version, including @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/contracts npm | From 4.1.0 | 4.3.2 |
@openzeppelin/contracts npm | From 4.1.0 | 4.3.2 |
@openzeppelin/contracts-upgradeable npm | From 4.1.0 | 4.3.2 |
@openzeppelin/contracts-upgradeable npm | From 4.1.0 | 4.3.2 |
Products include Openzeppelin Contracts.
How do I fix CVE-2021-41264?
Upgrade @openzeppelin/contracts to 4.3.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-41264 being exploited?
There is no known exploitation of CVE-2021-41264 in the wild and no public exploit code.
Other vulnerabilities in openzeppelin-contracts
- CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts
- CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
- CVE-2022-31170 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
Sources
Also known as GHSA-5vp3-v4hc-gx76.