Executive brief
The web3 library, used for interacting with the Ethereum blockchain, contains a flaw in how it handles digital wallet security. When a user loads an encrypted wallet, the sensitive private key is stored in a way that makes it accessible to other scripts running on the same webpage. If an attacker successfully uses a secondary attack like Cross-Site Scripting (XSS), they could steal the private key and gain full control over the user's digital assets.
Technical details
The web3.js library suffers from insecure credential storage because it exposes decrypted private keys in the browser's LocalStorage. While wallets are stored encrypted and require a password to load, the subsequent storage of the private key in LocalStorage allows it to be read in plaintext by any script with access to the origin's storage. An attacker could leverage a Cross-Site Scripting (XSS) vulnerability to programmatically retrieve these keys. This affects all versions of the library up to 1.5.2, and no official patch has been released; users are advised to use alternative modules or implement additional security layers.
Affected products
- Ethereum web3 All versions up to 1.5.2
Timeline
- 2019-04-26: disclosed: Vulnerability first disclosed by Snyk and reported by sshelton76.
- 2019-05-30: advisory: GitHub Advisory published.