CosmWasm wasmd uncontrolled resource consumption in ValidateBasic

Executive brief

A vulnerability in the wasmd component of CosmWasm could allow an attacker to cause unexpected resource consumption. By including an excessively large number of addresses in certain message types, an attacker can strain the system during the validation process. This may lead to minor service degradation or increased operational costs, though the overall impact is considered low.

Technical details

A vulnerability classified as CWE-400 (Uncontrolled Resource Consumption) exists in CosmWasm wasmd before version 0.52.0. The root cause is a lack of sufficient limits on the number of addresses that can be included in multiple message types, which are processed by the ValidateBasic function. An attacker can exploit this by sending specially crafted messages with a high address count, leading to excessive CPU or memory usage during validation. While the attack complexity is high, it can be initiated over the network without prior authentication. The issue is addressed in wasmd version 0.52.0.

Affected products

• CosmWasm wasmd < 0.52.0

Timeline

• 2024-08-08: advisory
• 2024-08-08: patched

References

• https://api.github.com/users/sushiwushi
• https://github.com/sushiwushi
• https://api.github.com/users/sushiwushi/gists%7B/gist_id%7D
• https://api.github.com/users/sushiwushi/repos
• https://avatars.githubusercontent.com/u/45194995?v=4
• https://api.github.com/users/sushiwushi/events%7B/privacy%7D