Incorrect Account Used for Signing in eth-ledger-bridge-keyring
Summary
GHSA-vg44-fw64-cpjx: Incorrect Account Used for Signing. Affects eth-ledger-bridge-keyring versions < 0.2.1. Fixed in 0.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eth-ledger-bridge-keyring is an npm package that provides functionality for signing with a BIP44 account using a Ledger hardware wallet. It allows users to interact with the Ethereum blockchain securely. The package is widely used by developers and applications that require hardware wallet integration. However, a vulnerability has been discovered in versions prior to 0.2.1, which can lead to incorrect account usage during the signing process.
Vulnerability Detail
The vulnerability in eth-ledger-bridge-keyring arises when a user signs a personal message or transaction without first adding the account. This issue affects cases where the user has already added the account in a previous session but did not add it again before signing. The serialization/deserialization process restores the previously added account, but it fails to restore the index instructing the keyring to use that account for signing. As a result, the account at index 0 is always used for signing, even if it is not the current account. This vulnerability does not impact users signing with the first account or using the legacy MEW/MyCrypto HD path.
How To Fix
Minimum fixed version
0.2.1
This is the first release that contains the fix.
npm install eth-ledger-bridge-keyring@0.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, a workaround is available. Users can remove and re-add the account before signing to ensure that the correct account is used. This workaround is effective as long as the account was added during the lifetime of the process.
Conclusion
The vulnerability in eth-ledger-bridge-keyring versions prior to 0.2.1 can lead to incorrect account usage during the signing process. To mitigate this risk, users should update to the latest version of the package or follow the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for eth-ledger-bridge-keyring →
FAQ
Any user or application utilizing eth-ledger-bridge-keyring versions prior to 0.2.1 may be affected if they sign with an account other than the first account or the legacy MEW/MyCrypto HD path.
The vulnerability can lead to incorrect account usage during the signing process. This could result in unintended transactions or messages being signed with the wrong account, potentially leading to financial loss or unauthorized access.
Yes, the vulnerability has been patched in version 0.2.1 of eth-ledger-bridge-keyring and version 0.2.2 of @metamask/eth-ledger-bridge-keyring. Users are advised to update to the latest version to mitigate the risk.
To update the package, you can use the package manager of your choice, such as npm or yarn. Run the command 'npm update eth-ledger-bridge-keyring' or 'yarn upgrade eth-ledger-bridge-keyring' to install the latest version.
If updating the package is not immediately feasible, you can follow the provided workaround. By removing and re-adding the account before signing, you can ensure that the correct account is used.
