CVE-2020-11093 : Security Advisory and Response

Hyperledger Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In Hyperledger Indy before version 1.12.4, an authorization bypass vulnerability exists due to a lack of signature verification on a specific transaction, allowing unauthorized alterations to the ledger.

Understanding CVE-2020-11093

This CVE involves an authorization bypass vulnerability in Hyperledger Indy, potentially leading to unauthorized modifications to the ledger.

What is CVE-2020-11093?

In Hyperledger Indy before version 1.12.4, a specific transaction lacks signature verification, enabling attackers to make unauthorized alterations to the ledger. Malicious actors can exploit this issue to write nym transactions to the ledger, change aliases of other DIDs, and modify ledger metadata.

The Impact of CVE-2020-11093

The vulnerability has a CVSS base score of 7.5, indicating a high severity issue. It has a low attack complexity and affects the integrity of the system, allowing attackers to manipulate ledger data without proper verification.

Technical Details of CVE-2020-11093

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The vulnerability stems from the lack of signature verification on a specific transaction in Hyperledger Indy before version 1.12.4, enabling unauthorized alterations to the ledger.

Affected Systems and Versions

Product: indy-node
Vendor: hyperledger
Versions Affected: < 1.12.4

Exploitation Mechanism

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged

Mitigation and Prevention

To address CVE-2020-11093, follow these mitigation strategies:

Immediate Steps to Take

Upgrade to version 1.12.4 or later to mitigate the vulnerability.
Monitor ledger activities for any suspicious transactions.

Long-Term Security Practices

Implement regular security audits and code reviews to identify and address vulnerabilities.
Educate users on secure ledger management practices to prevent unauthorized modifications.

Patching and Updates

Stay informed about security advisories and updates from Hyperledger Indy.