Skip to content
Fencer Intel
critical —

GHSA-8x4m-qw58-3pcx json

mppx has multiple payment bypass and griefing vulnerabilities

published 7mo ago modified 7mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

Multiple vulnerabilities were discovered in `tempo/charge` and `tempo/session` which allowed for undesirable behaviors, including: - Replaying `tempo/charge` transaction hashes across push/pull modes, across charge/session endpoints, and via concurrent requests - Performing free `tempo/charge` requests due to missing transfer log verification in pull-mode - Replaying `tempo/charge` credentials across routes via cross-route scope confusion (`memo`/`splits` not included in scope binding) - Manipulating the fee payer of a `tempo/charge` handler into paying for requests (missing sender signature before co-signing) - Bypassing `tempo/session` voucher signature verification - Piggybacking off existing `tempo/session` channels via settle voucher reuse and weak channel ID binding - Performing free `tempo/session` requests by exploiting channel reopen without on-chain settled state - Accepting deductions on finalized `tempo/session` channels - Bypassing payment on free routes via method-mismatch fallback - Griefing `tempo/session` channels via force-close detection bypass (`closeRequestedAt` not persisted)

### Patches

Fixed in 0.4.8.

### Workarounds

There are no workarounds available for these vulnerabilities.

Patch / fix

  • npm mppx 0.4.8

Is GHSA-8x4m-qw58-3pcx in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm mppx
<0.4.8
0.4.8

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel
  • CWE-294 Authentication Bypass by Capture-replay
  • CWE-345 Insufficient Verification of Data Authenticity

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.