CVE-2021-32738

Improper Authentication in npm/js-stellar-sdk

Identifiers

CVE-2021-32738, GHSA-6cgh-hjpw-q3gq

Package Slug

npm/js-stellar-sdk

Vulnerability

Improper Authentication

Description

js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the serverAccountID has signed the transaction. In js-stellar-sdk, the function does not verify that the server has signed the transaction. Applications that also used Utils.verifyChallengeTxThreshold or Utils.verifyChallengeTxSigners to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction. Applications calling Utils.readChallengeTx should update to, the first version with a patch for this vulnerability, to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.

Affected Versions

All versions before 8.2.3

Solution

Unfortunately, there is no solution available yet.

Last Modified

2021-07-13

source