Is CVE-2020-15130 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-15130 being exploited in the wild.

How severe is CVE-2020-15130?

Low severity, with a CVSS score of 3.1, published 30 July 2020.

Which products and versions are affected?

slpjs (npm) SEMVER:introduced=0,fixed=0.27.4.

Is there a fix for CVE-2020-15130?

Yes. slpjs (npm): upgrade to 0.27.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-15130 attacked?

It is attacked over the network.

Am I affected by CVE-2020-15130?

Check whether you run slpjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15130: SLPJS false-positive validation for NFT1 genesis transactions

CVE-2020-15130 · Severity: low · CVSS 3.1 · Published 2020-07-30

SLPJS is a JavaScript library for validating SLP (Simple Ledger Protocol) tokens, which are digital assets created on cryptocurrency networks. Versions before 0.27.4 incorrectly validate NFT1 child token creation, allowing attackers to create fake tokens without the required token burn. This could enable fraud, token counterfeiting, and loss of trust in the SLP token ecosystem.

Technologies: slpjs (npm). Vendors: npm.

Quick answers

Is CVE-2020-15130 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-15130 being exploited in the wild.
How severe is CVE-2020-15130?: Low severity, with a CVSS score of 3.1, published 30 July 2020.
Which products and versions are affected?: slpjs (npm) SEMVER:introduced=0,fixed=0.27.4.
Is there a fix for CVE-2020-15130?: Yes. slpjs (npm): upgrade to 0.27.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-15130 attacked?: It is attacked over the network.
Am I affected by CVE-2020-15130?: Check whether you run slpjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

slpjs (npm): upgrade to 0.27.4 or later
```
npm install slpjs@0.27.4
```

Technical details

The vulnerability is a validation bypass (CWE-697: Incorrect Comparison) in SLPJS's NFT1 Child Genesis transaction validator. The library incorrectly accepts NFT1 child token creation transactions that do not burn the required NFT1 Group token, violating the NFT1 specification. The bug allows a wallet implementation or attacker with network access to broadcast and validate fraudulent tokens. No authentication is required; the attack succeeds at the protocol validation layer. The vulnerability was fixed in version 0.27.4 with improved validation logic.

Affected products

SimpleLD SLPJS < 0.27.4

Identifiers

CVE-2020-15130
GHSA-cc2p-4jhr-xhhx

Timeline

2020-07-30: disclosed
2020-07-30: patched: Version 0.27.4 released

References

https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.