Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1mbWo3LTdnZnctNjRwZ84ABARb

Agent Dart is missing certificate verification checks

Certificate verification (in lib/agent/certificate.dart) has been found to contain two issues:

• During the delegation verification (in _checkDelegation function) the canister_ranges aren't verified. The impact of not checking the canister_ranges is that a subnet can sign canister responses in behalf of another subnet. You have more details in the IC specification here. Also for reference you can check how is this implemented in the agent-rs.
  - The certificate’s timestamp, i.e /time path, is not verified, meaning that the certificate effectively has no expiration time. The IC spec doesn’t specify an expiry times, it gives some suggestions, quoting: "A reasonable expiry time for timestamps in R.signatures and the certificate Cert is 5 minutes (analogously to the maximum allowed ingress expiry enforced by the IC mainnet). Delegations require expiry times of at least a week since the IC mainnet refreshes the delegations only after replica upgrades which typically happen once a week". For reference you can check how is this implemented in the agent-rs (here and here).

Additionally, seems replica signed queries aren’t implemented

Permalink: https://github.com/advisories/GHSA-fmj7-7gfw-64pg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mbWo3LTdnZnctNjRwZ84ABARb
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 7 hours ago
Updated: about 1 hour ago

Identifiers: GHSA-fmj7-7gfw-64pg, CVE-2024-48915
References:

• https://github.com/AstroxNetwork/agent_dart/security/advisories/GHSA-fmj7-7gfw-64pg
• https://github.com/AstroxNetwork/agent_dart/commit/0d200686aabcd9313c7bc3e675cbdc82f6b775cf
• https://nvd.nist.gov/vuln/detail/CVE-2024-48915
• https://github.com/AstroxNetwork/agent_dart/blob/f50971dfae3f536c1720f0084f28afbcf5d99cb5/lib/agent/certificate.dart#L162
• https://github.com/AstroxNetwork/agent_dart/blob/main/lib/agent/certificate.dart
• https://github.com/advisories/GHSA-fmj7-7gfw-64pg

Repository: https://github.com/AstroxNetwork/agent_dart
Blast Radius: 0.0

Affected Packages