Is CVE-2023-26488 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-26488 being exploited in the wild.

How severe is CVE-2023-26488?

Low severity, with a CVSS score of 3.1, published 3 March 2023.

Which products and versions are affected?

@openzeppelin/contracts (npm) SEMVER:introduced=4.8.0,fixed=4.8.2; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.8.0,fixed=4.8.2; OpenZeppelin Contracts >=4.8.0, =4.8.0, <4.8.2.

Is there a fix for CVE-2023-26488?

Yes. @openzeppelin/contracts (npm): upgrade to 4.8.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-26488 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-26488?

Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-26488: OpenZeppelin Contracts incorrect balance calculation in ERC721Consecutive

Q: Is there a fix for CVE-2023-26488?

Yes. @openzeppelin/contracts (npm): upgrade to 4.8.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-26488 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2023-26488?

Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-26488 · Severity: low · CVSS 3.1 · Published 2023-03-03

OpenZeppelin Contracts is a widely-used library for building smart contracts on blockchain platforms. The ERC721Consecutive component, which handles batch minting of non-fungible tokens (NFTs), fails to properly update token balances when processing batches of size 1. This can cause balance overflows when tokens are subsequently transferred, allowing attackers to manipulate token balances and potentially steal or duplicate tokens.

Technologies: @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: npm, OpenZeppelin.

Quick answers

Is CVE-2023-26488 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-26488 being exploited in the wild.
How severe is CVE-2023-26488?: Low severity, with a CVSS score of 3.1, published 3 March 2023.
Which products and versions are affected?: @openzeppelin/contracts (npm) SEMVER:introduced=4.8.0,fixed=4.8.2; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.8.0,fixed=4.8.2; OpenZeppelin Contracts >=4.8.0, <4.8.2; OpenZeppelin Contracts Upgradeable >=4.8.0, <4.8.2.
Is there a fix for CVE-2023-26488?: Yes. @openzeppelin/contracts (npm): upgrade to 4.8.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-26488 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-26488?: Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openzeppelin/contracts (npm): upgrade to 4.8.2 or later
```
npm install @openzeppelin/contracts@4.8.2
```
@openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.2 or later
```
npm install @openzeppelin/contracts-upgradeable@4.8.2
```

Technical details

The vulnerability exists in the ERC721Consecutive contract's batch minting logic, which contains an incorrect calculation that fails to update the balance mapping when a batch contains exactly one token. This issue (CWE-682: Incorrect Calculation) only affects batch size 1. When a single token is minted in a batch, the receiver's balance is not incremented in the balanceOf tracking. Subsequent transfers from the receiver can then cause integer overflow in the balance calculation. The vulnerability affects versions 4.8.0 through 4.8.1 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable, and has been patched in version 4.8.2. No authentication is required; any caller able to perform batch minting of size 1 can trigger the flaw.

Affected products

OpenZeppelin Contracts >=4.8.0, <4.8.2
OpenZeppelin Contracts Upgradeable >=4.8.0, <4.8.2

Identifiers

CVE-2023-26488
GHSA-878m-3g6q-594q

Timeline

2023-03-03: disclosed: GHSA advisory published
2023-03-03: patched: Fix released in version 4.8.2

References

https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-878m-3g6q-594q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.