CVE-2021-41264: OpenZeppelin Contracts UUPSUpgradeable uninitialized implementation vulnerability

CVE-2021-41264 · Severity: low · CVSS 3.1 · Published 2021-09-15

OpenZeppelin Contracts is a widely-used library for building smart contracts on blockchain networks. A flaw in the UUPSUpgradeable proxy pattern allows attackers to take control of uninitialized implementation contracts, potentially compromising all proxy instances that depend on them. This could lead to complete loss of contract control, fund theft, or manipulation of contract behavior across multiple projects.

Technologies: @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm). Vendors: npm.

Quick answers

Is CVE-2021-41264 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-41264 being exploited in the wild.
How severe is CVE-2021-41264?
Low severity, with a CVSS score of 3.1, published 15 September 2021.
Which products and versions are affected?
@openzeppelin/contracts (npm) SEMVER:introduced=4.1.0,fixed=4.3.2; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.1.0,fixed=4.3.2.
Is there a fix for CVE-2021-41264?
Yes. @openzeppelin/contracts (npm): upgrade to 4.3.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-41264 attacked?
It is attacked over the network.
Am I affected by CVE-2021-41264?
Check whether you run @openzeppelin/contracts (npm) or @openzeppelin/contracts-upgradeable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @openzeppelin/contracts (npm): upgrade to 4.3.2 or later
    npm install @openzeppelin/contracts@4.3.2
  • @openzeppelin/contracts-upgradeable (npm): upgrade to 4.3.2 or later
    npm install @openzeppelin/contracts-upgradeable@4.3.2

Technical details

The vulnerability exists in the UUPSUpgradeable proxy implementation (versions 4.1.0–4.3.1) where uninitialized implementation contracts can be exploited. The root cause is that an attacker can invoke the upgradeTo() or upgradeToAndCall() methods directly on an uninitialized implementation contract to redirect proxy instances to a malicious implementation. The attack requires no authentication and is network-reachable, making it easily exploitable. By calling the initializer function on the implementation contract, an attacker can gain ownership and perform unauthorized upgrades. The fix in version 4.3.2 restricts the upgrade mechanism to only function within a proxy context, preventing direct calls to implementation contracts. Workarounds include manually initializing implementation contracts or using a constructor to mark the implementation as initialized at deployment time.

Affected products

  • OpenZeppelin @openzeppelin/contracts 4.1.0 to 4.3.1
  • OpenZeppelin @openzeppelin/contracts-upgradeable 4.1.0 to 4.3.1

Identifiers

  • CVE-2021-41264
  • GHSA-5vp3-v4hc-gx76

Timeline

  • 2021-09-14: disclosed: Security advisory published
  • 2021-09-14: patched: Fix released in version 4.3.2
  • 2021-09-15: advisory: GHSA-5vp3-v4hc-gx76 published
  • 2021-09-09: other: OpenZeppelin team initialized over 150 uninitialized implementation contracts across multiple blockchain networks

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.