CVE-2018-15890: Deserialization of Untrusted Data in EthereumJ
Summary
CVE-2018-15890: Deserialization of Untrusted Data in EthereumJ. Affects org.ethereum:ethereumj-core versions < 1.12.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
EthereumJ is an open-source Java implementation of the Ethereum blockchain. It provides a platform for developers to build decentralized applications (DApps) and interact with the Ethereum network. The EthereumJ Core package (org.ethereum:ethereumj-core) is a fundamental component of EthereumJ, responsible for handling core functionalities such as syncing with the network and mining new blocks.
Vulnerability Detail
The vulnerability identified as CVE-2018-15890 involves unsafe deserialization of untrusted data in two specific classes of EthereumJ: mine/Ethash.java and crypto/ECKey.java. During the process of syncing and mining a new block, an attacker can exploit this vulnerability to execute arbitrary OS commands on the server. This can lead to unauthorized access, data breaches, and potential compromise of the entire Ethereum network.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advised to disable the affected functionality related to syncing and mining new blocks. This can be achieved by modifying the EthereumJ configuration or code to prevent the execution of the vulnerable code paths. However, this workaround may impact the overall functionality of the Ethereum network and should only be considered as a temporary measure until the vulnerability is properly fixed.
Conclusion
The vulnerability CVE-2018-15890 in EthereumJ exposes the network to potential attacks through unsafe deserialization. It is crucial to update the EthereumJ Core package to a patched version and implement proper input validation to mitigate the risk. For further support and assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.ethereum:ethereumj-core →
FAQ
EthereumJ is an open-source Java implementation of the Ethereum blockchain, providing a platform for building decentralized applications and interacting with the Ethereum network.
The vulnerability allows an attacker to execute arbitrary OS commands on the server, potentially leading to unauthorized access, data breaches, and compromise of the Ethereum network.
To fix this vulnerability, update the EthereumJ Core package to a version with the necessary security patches and ensure proper input validation and sanitization in the affected classes.
As a temporary workaround, disable the syncing and mining functionality related to the vulnerable code paths. However, this may impact the overall functionality of the Ethereum network.
For more information about EthereumJ, refer to the official documentation and community resources available on the EthereumJ project website.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
