Vulnerabilities > CVE-2017-12115 - Incorrect Authorization vulnerability in Ethereum Cpp-Ethereum

047910
CVSS 8.1 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
high complexity
ethereum
CWE-863

Summary

An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass.

Vulnerable Configurations

Part Description Count
Application
Ethereum
1

Common Weakness Enumeration (CWE)

Seebug

bulletinFamilyexploit
description### Summary An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability. ### Tested Versions Ethereum commit 4e1015743b95821849d001618a7ce82c7c073768 ### Product URLs http://cpp-ethereum.org ### CVSSv3 Score 6.8 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N ### CWE CWE-285: Improper Authorization ### Details CPP-Ethereum is a C++ ethereum client, one of the 3 most popular clients for the ethereum platform. One of the components that is part of cpp-ethereum is a JSON-RPC server which exposes various APIs to manage client/node functionality. Improper authorization checks in the implementation of the `miner_setEtherbase` API allows a remote attacker without any credentials to triggers functionality reserved only for a user with administrator privileges. We can observe a similar approach in two other clients (lack of any kind of authorization) but in this case the situation is exacerbated by the fact that: ``` - By default interface is bound to 0.0.0.0, which means it’s exposed to the world - The Content-Type set to ‘application/json’ during requests is not enforced, which means that even if eth JSON-RPC daemon is ran on machine behind a NAT the JSON-RPC APIs can still be easily triggered by CSRF or SSRF attacks. - older version of the same API had implemented an authorization check - there is no visible option to change the default JSON-RPC interface to localhost ``` For comparison let us take geth (the go ethereum client) which also implements a JSON-RPC interface but using much better security practices: ``` - by default the interface is bound to localhost - The “Content-Type” request header value must be set to ‘application/json’ - CORS settings are set to block by default all "cross-domain" requests ``` Let us take a look at miner_setEtherbase and describe in details improper/consistency check of authorization. ``` Line 253 bool AdminEth::miner_setEtherbase(string const& _uuidOrAddress) Line 254 { Line 255 Address a; Line 256 h128 uuid = fromUUID(_uuidOrAddress); Line 257 if (uuid) Line 258 a = m_keyManager.address(uuid); Line 259 else if (isHash<Address>(_uuidOrAddress)) Line 260 a = Address(_uuidOrAddress); Line 261 else Line 262 throw jsonrpc::JsonRpcException("Invalid UUID or address"); Line 263 Line 264 if (m_setMiningBenefactor) Line 265 m_setMiningBenefactor(a); Line 266 else Line 267 m_eth.setAuthor(a); Line 268 return true; Line 269 } ``` As we can see there is no check for calling user privileges which is done in couple other APIs via `RPC_ADMIN` macro. Same functionality is exposed over `admin_eth_setMiningBenefactor` API where at the beginning of API body, privileges check is made: ``` Line 147 bool AdminEth::admin_eth_setMiningBenefactor(string const& _uuidOrAddress, string const& _session) Line 148 { Line 149 RPC_ADMIN; Line 150 return miner_setEtherbase(_uuidOrAddress); Line 151 } ``` We are aware that this client is not recommended for mining and that the mentioned functionality related with the administrator interface is turned off by default. However when enabled the default behavior is insecure and can allow a remote attacker to perform unauthenticated RPC requests. ### Crash Information ``` icewall@ubuntu:~/bugs/cpp-ethereum/build/eth$ ./eth -j --ipc --private 123 --no-discovery --datadir `pwd`/data --config config.json --admin-via-http cpp-ethereum, a C++ Ethereum client cpp-ethereum 1.3.0 By cpp-ethereum contributors, (c) 2013-2016. See the README for contributors and credits. Networking disabled. To start, use netstart or pass --bootstrap or a remote host. JSONRPC Admin Session Key: Zt9zxSANHZs= icewall@ubuntu:~/bugs/cpp-ethereum$ curl -X POST --data '{"jsonrpc":"2.0","method":"miner_setEtherbase","params":["0x00803aba77731ed25d31dcafa6a9847a5261d518"],"id":1}' localhost:8545 {"id":1,"jsonrpc":"2.0","result":true} ``` ### Timeline * 2017-11-03 - Vendor Disclosure * 2018-01-09 - Public Release
idSSV:97068
last seen2018-01-10
modified2018-01-10
published2018-01-10
reporterRoot
titleCPP-Ethereum JSON-RPC miner_setEtherbase improper authorization Vulnerability(CVE-2017-12115)

Talos

idTALOS-2017-0467
last seen2019-05-29
published2018-01-09
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0467
titleCPP-Ethereum JSON-RPC miner_setEtherbase improper authorization Vulnerability