Ethereum ABI decoder Denial-of-Service (DoS) Vulnerability in eth-abi
Summary
GHSA-rqr8-pxh7-cq3g: Ethereum ABI decoder DoS when parsing ZST. Affects eth-abi versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
eth-abi is a Python package available on PyPI that provides functionality for decoding Ethereum ABI (Application Binary Interface) data. The Ethereum ABI is a specification that defines how data is encoded and decoded for communication between Ethereum smart contracts and external systems. The vulnerability in eth-abi allows for a Denial-of-Service (DoS) attack when parsing zero-sized-types (ZST) in the ABI data.
Vulnerability Detail
The Ethereum ABI specification allows for the presence of zero-sized-types (ZST), which can lead to a DoS vulnerability in the eth-abi package. When parsing a malicious payload and schema containing ZST, the decoder can consume excessive resources, potentially resulting in a DoS in server systems. The vulnerability arises from the fact that ZST can take up memory after parsing, even if they occupy zero bytes when stored on disk. This can lead to a situation where a parser tries to parse a large number of ZST elements, causing a significant memory usage and potential DoS. The vulnerability is considered moderate in severity with a CVSS score of 4.3.
How To Fix
Minimum fixed version
4.2.0
This is the first release that contains the fix.
pip install --upgrade "eth-abi==4.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Ethereum ABI decoder vulnerability in the eth-abi package allows for a Denial-of-Service (DoS) attack by exploiting the parsing of zero-sized-types (ZST). To mitigate this vulnerability, it is recommended to update to version 4.2.0 of the eth-abi package, which disallows the parsing of ZST. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for eth-abi →
FAQ
The vulnerability can lead to a Denial-of-Service (DoS) attack in server systems that use the eth-abi package. By exploiting the vulnerability, an attacker can cause excessive resource consumption, potentially leading to system crashes or unresponsiveness.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Pipfile.lock file as input.
No, Trail of Bits, the organization reporting this vulnerability, is informing vendors as a community service and does not seek a bug bounty for these issues.
No known exploits have been reported for this vulnerability at the time of disclosure. However, the potential for a DoS attack exists, and it is recommended to apply the fix to mitigate the risk.
Yes, this vulnerability can be exploited remotely. An attacker can send a malicious payload containing ZST to a server system that uses the eth-abi package, potentially causing a DoS by consuming excessive resources.
References
Related vulnerabilities
Recent vulnerabilities recorded for eth-abi.
