Insecure Credential Storage in web3
Summary
GHSA-27v7-qhfv-rqq8: Insecure Credential Storage in web3. Affects web3 versions < 1.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
web3 is an npm package that provides a JavaScript library for interacting with the Ethereum blockchain. It allows developers to create and manage wallets, send transactions, and interact with smart contracts. The package stores encrypted wallets in local storage and requires a password to load the wallet. However, a vulnerability exists where the private key of the loaded wallet is accessible via LocalStorage. This vulnerability poses a risk if there is a Cross-Site Scripting vulnerability that allows an attacker to access the private key.
Vulnerability Detail
The vulnerability in web3 arises from the insecure storage of encrypted wallets. While the wallets are encrypted and require a password to load, the private key is stored in LocalStorage once the wallet is loaded. This means that if an attacker can exploit a Cross-Site Scripting vulnerability, they can access the private key and potentially gain unauthorized access to the wallet and its associated Ethereum funds. The impact of this vulnerability can be significant, as it compromises the security of the user's Ethereum wallet and assets.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, there is no specific workaround provided for this vulnerability. However, developers can mitigate the risk by implementing strong security practices in their applications, such as ensuring they have proper Cross-Site Scripting protections in place and regularly monitoring for any signs of unauthorized access or suspicious activity.
Conclusion
Insecure Credential Storage in web3 poses a risk to the security of Ethereum wallets and assets. While no fix is currently available, developers should consider using alternative modules and regularly check for updates and security advisories. Implementing strong security practices and monitoring for suspicious activity can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for web3 →
FAQ
web3 is an npm package that provides a JavaScript library for interacting with the Ethereum blockchain. It allows developers to create and manage wallets, send transactions, and interact with smart contracts.
Insecure Credential Storage refers to the practice of storing sensitive credentials, such as private keys or passwords, in an insecure manner. In the case of web3, the private key of a loaded wallet is stored in LocalStorage, which can be accessed by an attacker if they can exploit a Cross-Site Scripting vulnerability.
LocalStorage is a web browser feature that allows websites to store data locally on a user's device. It is similar to cookies but has a larger storage capacity and is not sent to the server with every request. In the case of web3, the private key of a loaded wallet is stored in LocalStorage.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. If a website is vulnerable to XSS, an attacker can execute arbitrary code in the context of the victim's browser, potentially accessing sensitive information or performing unauthorized actions.
To protect your application from this vulnerability, it is important to implement proper Cross-Site Scripting protections, such as input validation and output encoding. Additionally, regularly monitoring for any signs of unauthorized access or suspicious activity can help detect and mitigate potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for web3.
