CVE-2021-32738:

The js-stellar-sdk library before version 8.2.3 contained a vulnerability (CWE-347: Improper Verification of Cryptographic Signature) where the `Utils.readChallengeTx` function failed to verify server signatures on challenge transactions, potentially allowing authentication bypass.

Score
A numerical rating that indicates how dangerous this vulnerability is.

6.5Medium

Published Date:Jul 2, 2021
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.1
EPSS Percentile:21%

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:3.6
Confidentiality Impact:NONE
Integrity Impact:HIGH
Availability Impact:NONE

Description Preview

Overview

The vulnerability affects the js-stellar-sdk library's SEP-10 authentication implementation, specifically the `Utils.readChallengeTx` function. This function was documented to verify that the server account had signed a challenge transaction, but failed to actually perform this verification step. This creates a security risk where applications might accept challenge transactions that were not properly signed by the server, potentially allowing unauthorized access. Applications that additionally used the `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` functions are not affected, as these functions correctly verify server signatures.

Remediation

To address this vulnerability:
1. Update js-stellar-sdk to version 8.2.3 or later, which properly implements signature verification in the `Utils.readChallengeTx` function.
2. If updating is not immediately possible, ensure your application is using `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` in addition to `Utils.readChallengeTx` to properly verify server signatures.
3. Review your authentication implementation to confirm it properly validates all aspects of challenge transactions.
4. Consider implementing additional security measures such as rate limiting and monitoring for authentication attempts.