GHSA-8r76-fr72-j32w Creator Verification Error when Bubblegum Activate
Attackers can bypass creator verification in Bubblegum by exploiting a Token Metadata provision, allowing unauthorized verification of creators.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-8r76-fr72-j32w?
GHSA-8r76-fr72-j32w is a vulnerability in mpl-bubblegum, published on 12 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This was an error found by @metamania01 of the Audit Company Solshield.
It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators.
The issue is now patched. For more info see. https://twitter.com/thehasheddude/status/1601642138143375360
Which versions are affected by GHSA-8r76-fr72-j32w?
4 open source packages ship an affected version, including mpl-bubblegum and mpl-token-metadata.
| Package | Affected | Fixed in |
|---|---|---|
mpl-bubblegum crates.io | All versions | 0.6.0 |
mpl-bubblegum crates.io | All versions | 0.6.0 |
mpl-token-metadata crates.io | From 1.5.0 | 1.6.3 |
mpl-token-metadata crates.io | From 1.5.0 | 1.6.3 |
How do I fix GHSA-8r76-fr72-j32w?
Upgrade mpl-bubblegum to 0.6.0 or later.
Is GHSA-8r76-fr72-j32w being exploited?
There is no known exploitation of GHSA-8r76-fr72-j32w in the wild and no public exploit code.