CVE-2018-1000022

EUVD-2018-1785 · Published Feb 9, 2018

Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can result in Bitcoin theft, if the user's wallet is not password protected. This attack appear to be exploitable via The victim must visit a web page with specially crafted javascript. This vulnerability appears to have been fixed in 3.0.5.

Technologies

Electrum Bitcoin Wallet

Weaknesses

CWE-862

CVSS scores

v3.05.3CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
v2.02.6AV:N/AC:H/Au:N/C:P/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Persistence Stealth Defense Impairment Credential Access

T1190Exploit Public-Facing Application T1211Exploitation for Stealth T1542.002Component Firmware T1556Modify Authentication Process

References

https://bitcointalk.org/index.php?topic=2702103.0
https://electrum.org/#home
https://github.com/spesmilo/electrum/issues/3374
https://www.reddit.com/r/Bitcoin/comments/7ooack/critical_electrum_vulnerability/

Potentially impacted assets

See if this affects your attack surface