Vulnerability · Published Mar 7, 2022 · Assigned by GitHub_M

CVE-2022-24738Account compromise in Evmos

High 8.1

In plain English

A high-severity improper authentication in evmos from tharsis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)1.1%top 35.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/tharsis/evmos	2.0.1	GHSA-5jgq-x857-p8xw
Go	github.com/tharsis/evmos	no fix listed	GO-2022-0348
Go	github.com/tharsis/evmos/v2	2.0.1	GO-2022-0348

Affected products (as reported)

Vendor	Product	Versions
tharsis	evmos	< 2.0.1

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/tharsis/evmos/security/advisories/GHSA-5jgq-x857-p8xw x_refsource_CONFIRM
https://github.com/tharsis/evmos/commit/28870258d4ee9f1b8aeef5eba891681f89348f71 x_refsource_MISC
https://github.com/tharsis/evmos/releases/tag/v2.0.1 x_refsource_MISC