CVE-2023-40014: OpenZeppelin Contracts vulnerable to Improper Escaping of Output
Summary
CVE-2023-40014: OpenZeppelin Contracts vulnerable to Improper Escaping of Output. Affects @openzeppelin/contracts versions >= 4.0.0, < 4.9.3. Fixed in 4.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenZeppelin Contracts is a library for secure smart contract development. It provides a collection of reusable and audited smart contracts that developers can use to build decentralized applications (dApps) on blockchain platforms. The library aims to enhance security and reduce the risk of vulnerabilities in smart contracts. However, a vulnerability has been discovered in OpenZeppelin Contracts versions 4.0.0 to 4.9.3 that can lead to improper escaping of output.
Vulnerability Detail
The vulnerability in OpenZeppelin Contracts arises when using ERC2771Context along with a custom trusted forwarder. In certain circumstances, calls originating from the forwarder with calldata shorter than 20 bytes may cause _msgSender to return address(0). This combination of circumstances is not common, as it does not occur with the default MinimalForwarder from OpenZeppelin Contracts or any deployed forwarder known to the team. However, if this vulnerability is exploited, it can result in unexpected behavior and potential security risks for contracts using the affected combination of components.
How To Fix
Minimum fixed version
4.9.3
This is the first release that contains the fix.
npm install @openzeppelin/contracts@4.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
OpenZeppelin Contracts versions 4.0.0 to 4.9.3 are vulnerable to an improper escaping of output vulnerability. This can lead to unexpected behavior and potential security risks for contracts using the affected combination of components. It is recommended to upgrade to OpenZeppelin Contracts version 4.9.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @openzeppelin/contracts →
FAQ
OpenZeppelin Contracts is a library for secure smart contract development. It provides a collection of reusable and audited smart contracts that developers can use to build decentralized applications (dApps) on blockchain platforms.
Versions 4.0.0 to 4.9.3 of OpenZeppelin Contracts are affected by this vulnerability.
The vulnerability can cause _msgSender to return address(0) in certain circumstances, leading to unexpected behavior and potential security risks for contracts using the affected combination of components.
Yes, the vulnerability has been patched in OpenZeppelin Contracts version 4.9.3.
To fix the vulnerability, developers should upgrade their OpenZeppelin Contracts dependency to version 4.9.3 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts.
