Critical Missing Authorization Vulnerability in Electrum Bitcoin Wallet
Summary
CVE-2018-1000022: Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can result in Bitcoin theft, if the user's wallet is not password... Affects electrum across 2 version ranges.
< 3.0.5-1
< a9973ce6ab60c21e8d074b1f0727d5dfc8ea7229
Fixed in 3.0.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Electrum is a popular Bitcoin wallet known for its lightweight design and ease of use. It allows users to manage their Bitcoin transactions securely and efficiently. However, prior to version 3.0.5, Electrum had a significant vulnerability in its JSONRPC interface, which could lead to unauthorized access and potential Bitcoin theft if the wallet is not password protected.
Vulnerability Detail
The vulnerability, identified as CVE-2018-1000022, arises from a missing authorization check in the JSONRPC interface of Electrum. This flaw allows an attacker to exploit the wallet by tricking the user into visiting a malicious web page containing specially crafted JavaScript. If the user's wallet is not secured with a password, the attacker could gain unauthorized access to the wallet and steal Bitcoin. The vulnerability was introduced in earlier versions of Electrum and was fixed in version 3.0.5.
How To Fix
Minimum fixed version
3.0.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade electrumTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid accessing untrusted web pages while using their Electrum wallet. Additionally, enabling a password for the wallet can help mitigate the risk of unauthorized access until the wallet is updated.
Conclusion
The Electrum Bitcoin Wallet vulnerability CVE-2018-1000022 poses a significant risk to users who have not updated to version 3.0.5. By following the recommended steps to upgrade and securing the wallet with a password, users can protect themselves from potential Bitcoin theft.
See every vulnerability recorded for electrum →
FAQ
CVE-2018-1000022 is a vulnerability in the Electrum Bitcoin Wallet that allows unauthorized access to the wallet through a missing authorization check in the JSONRPC interface.
If you are using a version prior to 3.0.5, your wallet is vulnerable. You can check your version in the wallet settings.
If an immediate upgrade is not possible, ensure your wallet is password protected and avoid visiting untrusted websites.
Failing to fix this vulnerability could lead to unauthorized access to your wallet and potential theft of your Bitcoin.
You can visit the official Electrum website or check vulnerability databases like Vulert for real-time alerts on open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for electrum.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
