CVE-2021-32738 : Security Advisory and Response

This article provides an overview of CVE-2021-32738, a vulnerability in js-stellar-sdk library.

Understanding CVE-2021-32738

CVE-2021-32738, titled "Utils.readChallengeTx does not verify the server account signature," affects js-stellar-sdk versions prior to 8.2.3.

What is CVE-2021-32738?

CVE-2021-32738 is a vulnerability in the

Utils.readChallengeTx

function of js-stellar-sdk that leads to improper validation of the server account signature.

The Impact of CVE-2021-32738

The vulnerability poses a medium severity threat with a CVSS base score of 6.5. It allows for high integrity impact with low privileges required for exploitation and a low attack complexity.

Technical Details of CVE-2021-32738

This section outlines the technical aspects of the CVE-2021-32738 vulnerability.

Vulnerability Description

The vulnerability arises from the failure of the

Utils.readChallengeTx

function in js-stellar-sdk versions prior to 8.2.3 to verify the server's signature on the challenge transaction.

Affected Systems and Versions

The vulnerability impacts js-stellar-sdk versions lower than 8.2.3.

Exploitation Mechanism

Attackers can exploit this vulnerability to bypass server account signature verification, potentially leading to unauthorized activities.

Mitigation and Prevention

To address CVE-2021-32738 and prevent exploitation, users and developers should take the following steps:

Immediate Steps to Take

Update affected applications to js-stellar-sdk version 8.2.3 or newer, where the vulnerability has been patched.

Long-Term Security Practices

Ensure regular monitoring for security updates and patches within the js-stellar-sdk ecosystem.

Patching and Updates

Stay informed about security advisories and promptly apply patches released by the js-stellar-sdk maintainers.