Vulnerability · Published Dec 24, 2020 · Assigned by GitHub_M

CVE-2020-11093Authorization bypass in Hyperledger Indy

High 7.5

In plain English

A high-severity security flaw in indy-node from hyperledger. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.2%top 32.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Hyperledger Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In Hyperledger Indy before version 1.12.4, there is lack of signature verification on a specific transaction which enables an attacker to make certain unauthorized alterations to the ledger. Updating a DID with a nym transaction will be written to the ledger if neither ROLE or VERKEY are being changed, regardless of sender. A malicious DID with no particular role can ask an update for another DID (but cannot modify its verkey or role). This is bad because 1) Any DID can write a nym transaction to the ledger (i.e., any DID can spam the ledger with nym transactions), 2) Any DID can change any other DID's alias, 3) The update transaction modifies the ledger metadata associated with a DID.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	indy-node	1.12.4	GHSA-wh2w-39f4-rpv2
PyPI	indy-node	1.12.4	PYSEC-2020-48

Affected products (as reported)

Vendor	Product	Versions
hyperledger	indy-node	< 1.12.4

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/hyperledger/indy-node/security/advisories/GHSA-wh2w-39f4-rpv2 x_refsource_CONFIRM
https://github.com/hyperledger/indy-node/blob/master/CHANGELOG.md#1124 x_refsource_MISC
https://github.com/hyperledger/indy-node/blob/master/docs/source/auth_rules.md x_refsource_MISC
https://github.com/hyperledger/indy-node/commit/55056f22c83b7c3520488b615e1577e0f895d75a x_refsource_MISC