CVE-2024-48915 Agent Dart missing certificate verification checks
Missing certificate verification in Agent Dart allows subnets to impersonate others and bypass expiration, requiring an upgrade to secure Internet Computer interactions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-48915?
CVE-2024-48915 is a high-severity vulnerability in AstroxNetwork agent_dart, published on 15 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation` function, the canister_ranges aren't verified. The impact of not checking the canister_ranges is that a subnet can sign canister responses in behalf of another subnet. The certificate’s timestamp, i.e /time path, is also not verified, meaning that the certificate effectively has no expiration time. Version 1.0.0-dev.29 implements appropriate certificate verification.
Weakness: CWE-295
Which versions are affected by CVE-2024-48915?
2 open source packages ship an affected version, including agent_dart.
| Package | Affected | Fixed in |
|---|---|---|
agent_dart Pub | All versions | 1.0.0-dev.29 |
agent_dart Pub | All versions | 1.0.0-dev.29 |
How do I fix CVE-2024-48915?
Upgrade agent_dart to 1.0.0-dev.29 or later.
Is CVE-2024-48915 being exploited?
There is no known exploitation of CVE-2024-48915 in the wild and no public exploit code.
Sources
Also known as GHSA-fmj7-7gfw-64pg.