Is CVE-2022-35916 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-35916 being exploited in the wild.

How severe is CVE-2022-35916?

Low severity, with a CVSS score of 3.1, published 14 August 2022.

Which products and versions are affected?

@openzeppelin/contracts (npm) SEMVER:introduced=4.6.0,fixed=4.7.2; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.6.0,fixed=4.7.2; OpenZeppelin Contracts 4.6.0 to 4.7.1; OpenZeppelin Contracts Upgradeable 4.6.0 to 4.7.1.

Is there a fix for CVE-2022-35916?

Yes. @openzeppelin/contracts (npm): upgrade to 4.7.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-35916 attacked?

It is attacked over the network.

Am I affected by CVE-2022-35916?

Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-35916: OpenZeppelin Contracts Arbitrum L2 cross-chain validation bypass

CVE-2022-35916 · Severity: low · CVSS 3.1 · Published 2022-08-14

OpenZeppelin Contracts is a widely-used Ethereum smart contract library that provides cross-chain utilities for the Arbitrum L2 blockchain. The library incorrectly classifies direct user wallet transactions as cross-chain messages originating from the Ethereum main network, bypassing intended cross-chain security checks. This could allow attackers to call protected functions as if they were legitimate cross-chain operations, potentially bypassing authorization checks designed for cross-chain interactions.

Technologies: @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: npm, OpenZeppelin.

Quick answers

Is CVE-2022-35916 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-35916 being exploited in the wild.
How severe is CVE-2022-35916?: Low severity, with a CVSS score of 3.1, published 14 August 2022.
Which products and versions are affected?: @openzeppelin/contracts (npm) SEMVER:introduced=4.6.0,fixed=4.7.2; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.6.0,fixed=4.7.2; OpenZeppelin Contracts 4.6.0 to 4.7.1; OpenZeppelin Contracts Upgradeable 4.6.0 to 4.7.1.
Is there a fix for CVE-2022-35916?: Yes. @openzeppelin/contracts (npm): upgrade to 4.7.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-35916 attacked?: It is attacked over the network.
Am I affected by CVE-2022-35916?: Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openzeppelin/contracts (npm): upgrade to 4.7.2 or later
```
npm install @openzeppelin/contracts@4.7.2
```
@openzeppelin/contracts-upgradeable (npm): upgrade to 4.7.2 or later
```
npm install @openzeppelin/contracts-upgradeable@4.7.2
```

Technical details

The vulnerability exists in the CrossChainEnabledArbitrumL2 and LibArbitrumL2 utilities, which misidentify externally owned account (EOA) calls made directly on Arbitrum L2 as cross-chain calls originating from Ethereum L1. The root cause is improper validation logic that fails to distinguish between genuine cross-chain messages and standard L2 transactions. An unauthenticated network attacker can exploit this by calling protected functions directly on L2, and the contract will incorrectly treat these as cross-chain-initiated calls. The impact is mitigated by the fact that any EOA action taken on L2 could alternatively be performed through the bridge in the absence of this check. The vulnerability was patched in OpenZeppelin Contracts v4.7.2.

Affected products

OpenZeppelin Contracts 4.6.0 to 4.7.1
OpenZeppelin Contracts Upgradeable 4.6.0 to 4.7.1

Identifiers

CVE-2022-35916
GHSA-9j3m-g383-29qr

Timeline

2022-08-14: disclosed: Vulnerability published
2022-08-14: patched: Fixed in v4.7.2

References

https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9j3m-g383-29qr

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.