Is CVE-2020-15131 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-15131 being exploited in the wild.

How severe is CVE-2020-15131?

Low severity, with a CVSS score of 3.1, published 30 July 2020.

Which products and versions are affected?

slp-validate (npm) SEMVER:introduced=0,fixed=1.2.2.

Is there a fix for CVE-2020-15131?

Yes. slp-validate (npm): upgrade to 1.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-15131 attacked?

It is attacked over the network.

Am I affected by CVE-2020-15131?

Check whether you run slp-validate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15131: Simple Ledger Protocol slp-validate false-positive NFT1 validation

CVE-2020-15131 · Severity: low · CVSS 3.1 · Published 2020-07-30

slp-validate is a JavaScript library used to validate Simple Ledger Protocol (SLP) transactions on the Bitcoin Cash blockchain. Versions prior to 1.2.2 incorrectly mark certain invalid NFT1 child token creation transactions as valid, allowing attackers or poorly-implemented wallets to create fraudulent tokens without the required token burns, undermining the integrity of NFT1 token issuance.

Technologies: slp-validate (npm). Vendors: npm.

Quick answers

Is CVE-2020-15131 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-15131 being exploited in the wild.
How severe is CVE-2020-15131?: Low severity, with a CVSS score of 3.1, published 30 July 2020.
Which products and versions are affected?: slp-validate (npm) SEMVER:introduced=0,fixed=1.2.2.
Is there a fix for CVE-2020-15131?: Yes. slp-validate (npm): upgrade to 1.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-15131 attacked?: It is attacked over the network.
Am I affected by CVE-2020-15131?: Check whether you run slp-validate (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

slp-validate (npm): upgrade to 1.2.2 or later
```
npm install slp-validate@1.2.2
```

Technical details

The vulnerability is a validation bypass (CWE-697) in the NFT1 Child Genesis transaction validation logic. The slp-validate library fails to properly enforce the NFT1 specification requirement that valid NFT1 child token genesis transactions must burn the corresponding NFT1 Group token. An attacker can submit a transaction that passes validation but violates the protocol specification, allowing creation of unauthorized NFT1 child tokens. The vulnerability affects all versions before 1.2.2 and is fixed by patching the validation rules. No authentication or special privileges are required to exploit this; any actor can submit malformed transactions to the blockchain.

Affected products

Simple Ledger Protocol slp-validate < 1.2.2

Identifiers

CVE-2020-15131
GHSA-6jmr-jfh7-xg3h

Timeline

2020-07-30: disclosed
2020-07-30: patched: Version 1.2.2 released

References

https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.