Is CVE-2023-30541 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-30541 being exploited in the wild.

How severe is CVE-2023-30541?

Low severity, with a CVSS score of 3.1, published 17 April 2023.

Which products and versions are affected?

@openzeppelin/contracts (npm) SEMVER:introduced=3.2.0,fixed=4.8.3; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=3.2.0,fixed=4.8.3; OpenZeppelin Contracts 3.2.0 through 4.8.2; OpenZeppelin Contracts Upgradeable 3.2.0 through 4.8.2.

Is there a fix for CVE-2023-30541?

Yes. @openzeppelin/contracts (npm): upgrade to 4.8.3 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-30541 attacked?

It is attacked over the network.

Am I affected by CVE-2023-30541?

Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-30541: OpenZeppelin Contracts TransparentUpgradeableProxy selector clash delegation bypass

CVE-2023-30541 · Severity: low · CVSS 3.1 · Published 2023-04-17

OpenZeppelin Contracts is a widely-used library providing secure smart contract building blocks, including a proxy pattern for upgradeable contracts. This vulnerability allows function calls in upgraded contracts to fail unexpectedly when their function selectors (4-byte identifiers) clash with the proxy's own selectors. An attacker could deliberately craft such a clash to make certain contract functions inaccessible, causing service disruption or unexpected behavior.

Technologies: @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts, OpenZeppelin Contracts Upgradeable. Vendors: npm, OpenZeppelin.

Quick answers

Is CVE-2023-30541 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-30541 being exploited in the wild.
How severe is CVE-2023-30541?: Low severity, with a CVSS score of 3.1, published 17 April 2023.
Which products and versions are affected?: @openzeppelin/contracts (npm) SEMVER:introduced=3.2.0,fixed=4.8.3; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=3.2.0,fixed=4.8.3; OpenZeppelin Contracts 3.2.0 through 4.8.2; OpenZeppelin Contracts Upgradeable 3.2.0 through 4.8.2.
Is there a fix for CVE-2023-30541?: Yes. @openzeppelin/contracts (npm): upgrade to 4.8.3 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-30541 attacked?: It is attacked over the network.
Am I affected by CVE-2023-30541?: Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openzeppelin/contracts (npm): upgrade to 4.8.3 or later
```
npm install @openzeppelin/contracts@4.8.3
```
@openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.3 or later
```
npm install @openzeppelin/contracts-upgradeable@4.8.3
```

Technical details

The vulnerability exists in TransparentUpgradeableProxy when a function in the implementation contract has a selector that clashes with one of the proxy's own selectors. If the clashing function has an incompatible ABI signature, the proxy attempts to decode arguments from calldata and reverts during this process, preventing proper delegation to the implementation. While accidental selector collisions are statistically negligible, they can be caused deliberately. The issue was fixed in v4.8.3 (v3.2.0 through v4.8.2 are affected). A potential workaround involves crafting specific calldata to bypass the proxy's argument decoding.

Affected products

OpenZeppelin Contracts 3.2.0 through 4.8.2
OpenZeppelin Contracts Upgradeable 3.2.0 through 4.8.2

Identifiers

CVE-2023-30541
GHSA-mx2q-35m2-x2rh

Timeline

2023-04-17: disclosed: Advisory published
2023-04-17: patched: Fixed in v4.8.3

References

https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-mx2q-35m2-x2rh

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.