GHSA-fg47-3c2x-m2wr CVE-2021-39167
TimelockController vulnerability in OpenZeppelin Contracts
- Severity
- 10.0 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.59%
- Chance of exploitation in the next 30 days. Higher than 75.66% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-269 Improper Privilege Management
- Fix
4.3.1- Upgrade @openzeppelin/contracts to this version or later
Description
Impact
A vulnerability in TimelockController allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.
Patches
A fix is included in the following releases of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable:
- 4.3.1
- 3.4.2
- 3.4.2-solc-0.7
Deployed instances of TimelockController should be replaced with a fixed version by migrating all assets, ownership, and roles.
Workarounds
Revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
References
Credits
The issue was identified by an anonymous white hat hacker through Immunefi.
For more information
If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| @openzeppelin/contracts | >= 4.0.0, < 4.3.1 |
4.3.1 |
| @openzeppelin/contracts | >= 3.3.0, < 3.4.2 |
3.4.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
@openzeppelin/contracts npm → 4.3.1
- npm
npm install @openzeppelin/contracts@4.3.1- yarn
yarn add @openzeppelin/contracts@4.3.1- pnpm
pnpm add @openzeppelin/contracts@4.3.1
Severity breakdown
CVSS 3.1 10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
- Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-9rcw-c2f9-2j55 OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers | Medium | Also affects @openzeppelin/contracts |
| GHSA-9vx6-7xxf-x967 OpenZeppelin Contracts base64 encoding may read from potentially dirty memory | High | Also affects @openzeppelin/contracts |
| GHSA-699g-q6qh-q4v8 OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4 | High | Also affects @openzeppelin/contracts |
| GHSA-g4vp-m682-qqmp OpenZeppelin Contracts vulnerable to Improper Escaping of Output | Medium | Also affects @openzeppelin/contracts |
| GHSA-wprv-93r4-jj2p OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees | Medium | Also affects @openzeppelin/contracts |
| GHSA-5h3x-9wvq-w4m2 OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning | Medium | Also affects @openzeppelin/contracts |
| GHSA-mx2q-35m2-x2rh OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated | Medium | Also affects @openzeppelin/contracts |
| GHSA-93hq-5wgc-jc82 GovernorCompatibilityBravo may trim proposal calldata | High | Also affects @openzeppelin/contracts |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor