MultiversX Wallet Vulnerability Report

Service Description

The MultiversX Wallet platform offers features such as a seamless user onboarding experience, intuitive transaction management, and real-time balance tracking. It also supports features like staking, which allows users to participate in the MultiversX network's consensus mechanism and earn rewards for securing the blockchain.

Affected Service

https://testnet-wallet.multiversx.com - (Build 1.3.0-b510169)

https://devnet-wallet.multiversx.com - (Build 1.4.1-910a340)

https://wallet.multiversx.com - (Build 1.4.1-910a3403)

Vulnerability Summary

[CWE-20] - CSV Injection

A CSV Injection vulnerability (CWE-20) was found in the MultiversX Wallet platform. It allows an attacker to inject malicious CSV payloads in the `Data` field of a transaction. When the victim export and opens the CSV history transactions file, the payload gets executed, potentially leading to unauthorized code execution or malicious actions.

Reproduction Steps

CSV Injection - CWE-20.

1. Send a small amount of funds to the victim's public key, including a CSV payload in the data field.

For example:

E.g. payload:

=cmd|'/C PowerShell -Command for ($i=0; $i -lt 1000; $i++) {Write-Host HELLO}; pause'!A0'

This payload executes a PowerShell command to print HELLO 1000 times.

2. Wait for the victim to receive the transaction and download the transaction history using the "Export Transactions CSV" feature of the MultiversX Wallet.

3. When the victim opens the exported CSV file, the payload embedded in the data field is triggered and executed. This can lead to the execution of arbitrary code on the victim's system, potentially resulting in malware infection or unauthorized access.

It's important to highlight the risk that mass transactions with CSV payload targeting the biggest EGLD holders can potentially result in the theft of significant funds from those holders. The exploitation of this vulnerability poses a significant risk to the security and integrity of the MultiversX Wallet platform and its users.

PoC

Recommendation Fixes / Remediation

Implement Input Sanitization: Apply strict input validation and sanitization mechanisms to the data input fields, including the CSV import functionality. Ensure that user-supplied data is properly filtered and sanitized to prevent the execution of malicious commands or code.

Reference

https://medium.com/cryptogennepal/what-is-a-csv-injection-attack-9208b54b4598

https://testnet-wallet.multiversx.com

https://devnet-wallet.multiversx.com

https://wallet.multiversx.com

Other MultiversX Report:

https://neroteam.com/blog/multiversx-web-ide-smart-contracts-playground-exploit

Security researchers