CVE-2023-34458 : Security Advisory and Response

A high-severity vulnerability has been identified in mx-chain-go, the official implementation of the MultiversX blockchain protocol, written in golang. The vulnerability, tracked as CVE-2023-34458, allowed for an uncontrolled resource consumption leading to a potential Denial of Service (DoS) attack. This vulnerability has been addressed in version 1.4.17.

Understanding CVE-2023-34458

This section dives into the details of the CVE-2023-34458 vulnerability in mx-chain-go.

What is CVE-2023-34458?

CVE-2023-34458 involves the relayed transactions in mx-chain-go always incrementing the nonce, which could be exploited for a DoS attack.

The Impact of CVE-2023-34458

The vulnerability could have allowed malicious actors to target specific accounts and cause a DoS attack by increasing the inner transaction's sender account nonce.

Technical Details of CVE-2023-34458

Let's explore the technical aspects of CVE-2023-34458 to understand the vulnerability further.

Vulnerability Description

When an inner transaction failed during a relayed transaction in mx-chain-go, it resulted in an increased nonce for the inner transaction's sender account, potentially enabling a DoS attack.

Affected Systems and Versions

The vulnerability affects versions of mx-chain-go prior to 1.4.17, making those versions susceptible to this resource consumption issue.

Exploitation Mechanism

By exploiting the flaw in the relayed transactions, threat actors could have executed a targeted DoS attack on specific accounts within the MultiversX blockchain protocol.

Mitigation and Prevention

To secure your systems and prevent exploitation, follow the guidance provided below.

Immediate Steps to Take

Upgrade to version 1.4.17 of mx-chain-go to mitigate the CVE-2023-34458 vulnerability and prevent potential resource consumption attacks.

Long-Term Security Practices

Ensure regular updates and patches for all software components to address vulnerabilities promptly and enhance overall system security.

Patching and Updates

Stay informed about security advisories and releases from MultiversX to apply necessary patches and updates promptly to protect your systems.