CVE-2021-39167: OpenZeppelin Contracts TimelockController privilege escalation

CVE-2021-39167 · Severity: low · CVSS 3.1 · Published 2021-08-30

OpenZeppelin Contracts provides reusable Solidity smart contract components used to secure blockchain applications. A vulnerability in the TimelockController—a contract that enforces time delays on sensitive operations—allowed actors with executor privileges to bypass security controls and seize complete control of the timelock, including all assets and functions protected by it. This could enable complete compromise of governance systems and theft of funds.

Technologies: OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: OpenZeppelin.

Quick answers

Is CVE-2021-39167 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-39167 being exploited in the wild.
How severe is CVE-2021-39167?
Low severity, with a CVSS score of 3.1, published 30 August 2021.
Which products and versions are affected?
OpenZeppelin Contracts 4.0.0 through 4.3.0, 3.3.0 through 3.4.1, 3.3.0-solc-0.7, 3.4.0-solc-0.7, 3.4.1-solc-0.7-2; OpenZeppelin Contracts Upgradeable 4.0.0 through 4.3.0, 3.3.0 through 3.4.1, 3.3.0-solc-0.7, 3.4.0-solc-0.7, 3.4.1-solc-0.7-2.
Is there a fix for CVE-2021-39167?
A patch was published on 2021-08-27: Patches released in versions 4.3.1, 3.4.2, and 3.4.2-solc-0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-39167 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-39167?
Check whether you run OpenZeppelin Contracts or OpenZeppelin Contracts Upgradeable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation (CWE-266) in TimelockController. An attacker with the executor role could reset the delay parameter to 0 and escalate their privileges to gain unrestricted access to all assets and functions held in the contract. The risk is particularly severe if the executor role is configured as "open," allowing any network-accessible caller to assume the executor role without authentication. The fix is available in OpenZeppelin Contracts 4.3.1, 3.4.2, and 3.4.2-solc-0.7. Deployed instances must be migrated to patched versions by re-deploying the contract and transferring all assets and roles.

Affected products

  • OpenZeppelin Contracts 4.0.0 through 4.3.0, 3.3.0 through 3.4.1, 3.3.0-solc-0.7, 3.4.0-solc-0.7, 3.4.1-solc-0.7-2
  • OpenZeppelin Contracts Upgradeable 4.0.0 through 4.3.0, 3.3.0 through 3.4.1, 3.3.0-solc-0.7, 3.4.0-solc-0.7, 3.4.1-solc-0.7-2

Identifiers

  • CVE-2021-39167
  • GHSA-fg47-3c2x-m2wr

Timeline

  • 2021-08-27: disclosed: Publicly disclosed via GitHub advisory
  • 2021-08-27: patched: Patches released in versions 4.3.1, 3.4.2, and 3.4.2-solc-0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.