GHSA-j2cr-jc39-wpx5 Barberry Security Advisory - regarding x/auth periodic vesting accounts
Attackers can lock victim funds by initializing malicious vesting accounts, preventing withdrawals. Cosmos SDK users must upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-j2cr-jc39-wpx5?
GHSA-j2cr-jc39-wpx5 is a vulnerability in github.com/cosmos/cosmos-sdk, published on 22 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
In PeriodicVestingAccount, defined in x/auth, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able to withdraw them.
Patches
>= v0.46.13 for Cosmos SDK v0.46.x >= v0.47.3 for Cosmos SDK v0.47.x
If a network backported periodic vesting accounts to earlier versions of the SDK, those networks are affected too.
Workarounds
There is no workaround for this issue. Upgrade immediately.
References
- Patched versions release notes: v0.47.3, v0.46.13.
- Forum Post
Which versions are affected by GHSA-j2cr-jc39-wpx5?
9 open source packages ship an affected version, including github.com/cosmos/cosmos-sdk.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cosmos/cosmos-sdk Go | All versions | 0.46.13, 0.47.3 |
github.com/cosmos/cosmos-sdk Go | From 0.46.0 | 0.46.13 |
github.com/cosmos/cosmos-sdk Go | From 0.46.0 | 0.46.13 |
github.com/cosmos/cosmos-sdk Go | From 0.46.0 | 0.46.13 |
github.com/cosmos/cosmos-sdk Go | From 0.46.0 | 0.46.13 |
github.com/cosmos/cosmos-sdk Go | From 0.47.0 | 0.47.3 |
3 more packages
github.com/cosmos/cosmos-sdk Go | From 0.47.0 | 0.47.3 |
github.com/cosmos/cosmos-sdk Go | From 0.47.0 | 0.47.3 |
github.com/cosmos/cosmos-sdk Go | From 0.47.0 | 0.47.3 |
How do I fix GHSA-j2cr-jc39-wpx5?
Upgrade github.com/cosmos/cosmos-sdk to a fixed version for your release line: 0.46.13 or 0.47.3.
Is GHSA-j2cr-jc39-wpx5 being exploited?
There is no known exploitation of GHSA-j2cr-jc39-wpx5 in the wild and no public exploit code.
Sources
Also known as GHSA-w44m-8mv2-v78h, GO-2023-1861.