CVE-2021-39168: OpenZeppelin Contracts TimelockController privilege escalation

CVE-2021-39168 · Severity: low · CVSS 3.1 · Published 2021-08-30

OpenZeppelin Contracts is a widely-used library that provides secure, tested smart contract components for blockchain applications. TimelockController is a contract that enforces time delays on sensitive operations to prevent unauthorized changes. A vulnerability allowed accounts with executor privileges to bypass the timelock delay and gain unrestricted control over assets, potentially draining funds or transferring ownership of blockchain-based systems using this component.

Technologies: OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: OpenZeppelin.

Quick answers

Is CVE-2021-39168 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-39168 being exploited in the wild.
How severe is CVE-2021-39168?
Low severity, with a CVSS score of 3.1, published 30 August 2021.
Which products and versions are affected?
OpenZeppelin Contracts >=4.0.0, <=4.3.0; >=3.3.0, <=3.4.1; OpenZeppelin Contracts Upgradeable >=4.0.0, <=4.3.0; >=3.3.0, <=3.4.1.
Is there a fix for CVE-2021-39168?
A patch was published on 2021-08-26: Patches released in versions 4.3.1, 3.4.2, 3.4.2-solc-0.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-39168 attacked?
It is attacked over the network.
Am I affected by CVE-2021-39168?
Check whether you run OpenZeppelin Contracts or OpenZeppelin Contracts Upgradeable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a privilege escalation flaw (CWE-266) in OpenZeppelin's TimelockController contract. An actor with the executor role could reset the timelock delay to 0 and escalate their privileges to gain immediate unrestricted access to assets. If the executor role was configured as "open" (meaning anyone can assume it), an attacker could exploit this remotely without authentication. The root cause involves incorrect privilege assignment logic that failed to enforce timelock constraints on delay-reset operations. Patches were released in versions 4.3.1, 3.4.2, and 3.4.2-solc-0.7; deployed instances required migration of assets and roles to patched versions.

Affected products

  • OpenZeppelin Contracts >=4.0.0, <=4.3.0; >=3.3.0, <=3.4.1
  • OpenZeppelin Contracts Upgradeable >=4.0.0, <=4.3.0; >=3.3.0, <=3.4.1

Identifiers

  • CVE-2021-39168
  • GHSA-vrw4-w73r-6mm8

Timeline

  • 2021-08-26: disclosed: Advisory published by OpenZeppelin
  • 2021-08-26: patched: Patches released in versions 4.3.1, 3.4.2, 3.4.2-solc-0.7
  • 2021-08-27: other: CVE-2021-39168 and GHSA-vrw4-w73r-6mm8 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.