Zero-day vulnerability in PyBitmessage

Remote code execution

The vulnerability was used in the wild against PyBitmessage v0.6.2 users. According to vendor's notice, Bitmessage developer Peter Šurda's Bitmessage addresses were compromised as well by the attackers.

Vulnerability details

Advisory: SB2018021404 - Remote code execution in PyBitmessage

Vulnerable component: PyBitmessage

CVE-ID:

CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

CWE-ID: CWE-20 - Improper input validation

Description:

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a message encoding bug. A remote attacker can send a specially crafted message, run an automated script looking in ~/.electrum/wallets, open a remote reverse shell, gain access to other files and execute arbitrary code.

Successful exploitation of the vulnerability results in system compromise.

Note: the vulnerability has been actively exploited to create a remote shell and steal bitcoins from Electrum wallets.

External links:

https://bitmessage.org/wiki/Main_Page
https://www.securityweek.com/zero-day-attack-prompts-emergency-patch-bitmessage-client

About zero-day vulnerabilities

Zero-day vulnerability is an undisclosed vulnerability in software that hackers can exploit to compromise computer programs, gain unauthorized access to sensitive data, penetrate networks, etc. We consider vulnerability a zero-day when there is no solution provided from software vendor and the vulnerability is being actively exploited by malicious actors.

Zero-day candidate is a potential zero-day vulnerability in software which might have been used in targeted attacks, however there is no evidence to support this suggestion.