CVE-2023-30542 GovernorCompatibilityBravo may trim proposal calldata
Attackers can create governance proposals with mismatched array lengths, causing actions to execute without intended calldata, potentially altering contract state unexpectedly.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-30542?
CVE-2023-30542 is a medium-severity vulnerability in openzeppelin-contracts, published on 16 Apr 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata. This issue has been patched in 4.8.3. As a workaround, ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.
Weakness: CWE-20
Which versions are affected by CVE-2023-30542?
4 open source packages ship an affected version, including @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@openzeppelin/contracts npm | From 4.3.0 | 4.8.3 |
@openzeppelin/contracts npm | From 4.3.0 | 4.8.3 |
@openzeppelin/contracts-upgradeable npm | From 4.3.0 | 4.8.3 |
@openzeppelin/contracts-upgradeable npm | From 4.3.0 | 4.8.3 |
Products include Openzeppelin Contracts, Openzeppelin Contracts Upgradeable.
How do I fix CVE-2023-30542?
Upgrade @openzeppelin/contracts to 4.8.3 or later.
Is CVE-2023-30542 being exploited?
There is no known exploitation of CVE-2023-30542 in the wild and no public exploit code.
Other vulnerabilities in openzeppelin-contracts
- CVE-2021-39167 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-39168 TimelockController vulnerability in OpenZeppelin Contracts
- CVE-2021-41264 UUPSUpgradeable vulnerability in OpenZeppelin Contracts
- CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts
- CVE-2022-31198 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
Sources
Also known as GHSA-93hq-5wgc-jc82.