# GHSA-7q74-g774-7x3g: Interchain Security: The signers of ICS messages do not need to match the provider address > Attackers can impersonate validators to modify consumer chain settings or halt chains due to missing signer validation in Interchain Security messages. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 5 Sep 2024 - **Also known as:** GO-2024-3121 ## What is GHSA-7q74-g774-7x3g? GHSA-7q74-g774-7x3g is a missing authorization vulnerability in github.com/cosmos/interchain-security, published on 5 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description ### Context ICS has the following four messages that enable validators on the provider chain to perform different actions: - `MsgOptIn` -- adds a validator to the consumer chain’s active set - `MsgOptOut` -- removes a validator from the consumer chain’s active set - `MsgAssignConsumerKey` -- changes the consensus key used for a validator’s operations on a consumer chain - `MsgSetConsumerCommissionRate` -- sets a validator’s consumer-specific commission rate Normally, only the respective validators are allowed to perform these actions. ### Issue The upgrade to SDK 0.50, introduced a [signer](https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer) field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. For more context, check out the code: - proto files https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52 - message validation https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106 - message handling https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52 ### Severity assessment The severity assessment is based on [this framework](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md). **Potential impact:** Catastrophic - By changing consumer keys for 1/3+ of a consumer chain's validator set, any user could cause a consumer chain to halt. Given that the consumer is down, the provider will jail provider validators for consumer downtime, so this exploit would not have impacted the provider directly. Consumer chain halts would need to be addressed by a provider-side patch. - By changing consumer keys on a consumer node, double signing, and submitting evidence back to the provider, any user could tombstone any provider validator. This would cause the provider's active set to change. At scale, this exploit could be applied to all active provider validators and a well-funded attacker could then run their own nodes and take over consensus on the provider and on consumer chains. **Likelihood:** Rare - The bug was discovered internally. There is no evidence that any external party has identified this vulnerability. - The bug has been live for two weeks with no issues. - All four message types are ones that only validators use, and rarely use in daily operations. - In the Cosmos Hub’s recent history (May - Aug), there has been only one instance of any of these message types, which was performed in accordance with chain rules. - The catastrophic exploits (such as tombstoning the entire validator set of the provider) are also extremely complex. They involve several operations that are not well-understood by many people, and the entire exploit must occur quickly and at-scale to avoid other node operators responding defensively. ## Which versions are affected by GHSA-7q74-g774-7x3g? 15 open source packages ship an affected version, including github.com/cosmos/interchain-security, github.com/cosmos/interchain-security/v2 and github.com/cosmos/interchain-security/v3. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `github.com/cosmos/interchain-security` | Go | All versions | None | | `github.com/cosmos/interchain-security` | Go | All versions | None | | `github.com/cosmos/interchain-security` | Go | All versions | None | | `github.com/cosmos/interchain-security/v2` | Go | All versions | None | | `github.com/cosmos/interchain-security/v2` | Go | All versions | None | | `github.com/cosmos/interchain-security/v2` | Go | All versions | None | | `github.com/cosmos/interchain-security/v3` | Go | All versions | None | | `github.com/cosmos/interchain-security/v3` | Go | All versions | None | | `github.com/cosmos/interchain-security/v3` | Go | All versions | None | | `github.com/cosmos/interchain-security/v4` | Go | All versions | None | | `github.com/cosmos/interchain-security/v4` | Go | All versions | None | | `github.com/cosmos/interchain-security/v4` | Go | All versions | None | | `github.com/cosmos/interchain-security/v5` | Go | From 5.1.0 | 5.2.0 | | `github.com/cosmos/interchain-security/v5` | Go | From 5.1.0 | 5.2.0 | | `github.com/cosmos/interchain-security/v5` | Go | From 5.1.0 | 5.2.0 | ## How do I fix GHSA-7q74-g774-7x3g? Apply the vendor's patch. ## Is GHSA-7q74-g774-7x3g being exploited? There is no known exploitation of GHSA-7q74-g774-7x3g in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-7q74-g774-7x3g and fix it if it is affected. What it is: GHSA-7q74-g774-7x3g is a missing authorization vulnerability in github.com/cosmos/interchain-security, published on 5 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-7q74-g774-7x3g in the wild and no public exploit code. Affected packages and fixed versions: - github.com/cosmos/interchain-security (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v2 (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v2 (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v2 (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v3 (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v3 (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v3 (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v4 (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v4 (Go): affected all versions; no fix listed - github.com/cosmos/interchain-security/v4 (Go): affected all versions; no fix listed Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-7q74-g774-7x3g/ (Markdown: https://insights.sbomify.com/GHSA-7q74-g774-7x3g/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-7q74-g774-7x3g --- From sbomify Insights: https://insights.sbomify.com/GHSA-7q74-g774-7x3g/ Summaries are generated and may contain mistakes; the official description above is the record.