CVE-2019-9115
📋 TL;DR
This vulnerability in irisnet-crypto allows remote code execution due to unsafe eval() usage in util/utils.js. Attackers can execute arbitrary JavaScript code on affected systems running IRISnet blockchain applications. Any application using vulnerable versions of irisnet-crypto is affected.
💻 Affected Systems
- irisnet-crypto
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal private keys, manipulate blockchain transactions, and pivot to other systems.
Likely Case
Remote code execution leading to data theft, service disruption, or cryptocurrency theft in IRISnet applications.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, though eval() usage remains dangerous.
🎯 Exploit Status
The vulnerability is in a public JavaScript file with unsafe eval() usage, making exploitation straightforward for attackers who can control input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.7
Vendor Advisory: https://github.com/irisnet/irisnet-crypto/issues/60
Restart Required: Yes
Instructions:
1. Update irisnet-crypto to version 1.1.7 or later using npm update irisnet-crypto. 2. Restart all applications/services using irisnet-crypto. 3. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for all data passed to irisnet-crypto functions
Content Security Policy
allImplement strict Content Security Policy headers to restrict eval() usage
🧯 If You Can't Patch
- Isolate affected systems in network segments with strict egress filtering
- Implement application-level firewalls to monitor and block suspicious eval() usage patterns
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list irisnet-crypto to see if version is below 1.1.7Check Version:
npm list irisnet-crypto | grep irisnet-cryptoVerify Fix Applied:
Verify irisnet-crypto version is 1.1.7 or higher using npm list irisnet-crypto📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution patterns
- Suspicious eval() calls in application logs
- Unexpected process spawns from Node.js applications
Network Indicators:
- Unusual outbound connections from IRISnet applications
- Suspicious data exfiltration patterns
SIEM Query:
source="application_logs" AND (eval OR Function OR script) AND process="node"