CVE-2022-31020 Remote code execution in Indy's NODE_UPGRADE transaction

What is CVE-2022-31020?

CVE-2022-31020 is a high-severity code injection vulnerability in hyperledger indy-node, published on 6 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.

Weakness: CWE-287, CWE-20

Which versions are affected by CVE-2022-31020?

3 open source packages ship an affected version, including indy-node. It affects 1 product.

Products include Linuxfoundation Indy-Node.

How do I fix CVE-2022-31020?

Upgrade indy-node to 1.12.5rc1 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-31020 being exploited?

There is no known exploitation of CVE-2022-31020 in the wild and no public exploit code.

Other vulnerabilities in hyperledger indy-node

• CVE-2022-31006 Hyperledger Indy DOS vulnerability High 7.5
• CVE-2020-11093 Authorization bypass in Hyperledger Indy High 7.5
• CVE-2020-11090 Uncontrolled Resource Consumption in Indy Node High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r6v9-p59m-gj2p, PYSEC-2022-265.