CVE-2021-37491 – This vulnerability in Dogecoin Core allows atta... (How to Fix)

📋 TL;DR

This vulnerability in Dogecoin Core allows attackers to view sensitive wallet information through the CWallet::CreateTransaction() function. It affects Dogecoin Core 1.14.3 and earlier versions. Attackers could potentially access private wallet data that should remain confidential.

💻 Affected Systems

Products:

Dogecoin Core

Versions: 1.14.3 and earlier

Operating Systems: All platforms running Dogecoin Core

Default Config Vulnerable: ⚠️ Yes

Notes: Affects the wallet functionality of Dogecoin Core software

📦 What is this software?

Dogecoin by Dogecoin

View all CVEs affecting Dogecoin →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain access to sensitive wallet information including private keys or transaction details, potentially leading to theft of cryptocurrency funds.

🟠

Likely Case

Information disclosure of wallet metadata or transaction details that could be used for targeted attacks or privacy violations.

🟢

If Mitigated

Limited information exposure with no direct fund loss if proper wallet security practices are followed.

🌐 Internet-Facing: LOW

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires access to the wallet functionality, likely through local or remote API access

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Dogecoin Core 1.14.4 or later

Vendor Advisory: https://github.com/dogecoin/dogecoin/issues/2279

Restart Required: Yes

Instructions:

1. Backup wallet.dat file
2. Stop Dogecoin Core
3. Download and install Dogecoin Core 1.14.4 or later
4. Restart Dogecoin Core
5. Verify wallet functionality

🔧 Temporary Workarounds

Disable wallet functionality

all

Run Dogecoin Core without wallet functionality using -disablewallet flag

dogecoind -disablewallet

Use external wallet

all

Use external wallet software instead of built-in Dogecoin Core wallet

🧯 If You Can't Patch

Restrict access to Dogecoin Core RPC interface
Monitor for unusual wallet activity or access attempts

🔍 How to Verify

Check if Vulnerable:

Check Dogecoin Core version: dogecoin-cli getnetworkinfo | grep version

Check Version:

dogecoin-cli getnetworkinfo | grep version

Verify Fix Applied:

Verify version is 1.14.4 or later and check wallet functionality

📡 Detection & Monitoring

Log Indicators:

Unusual wallet access patterns
Multiple failed transaction attempts
Unexpected RPC calls to wallet functions

Network Indicators:

Unusual RPC traffic to wallet port
Multiple connections from suspicious IPs

SIEM Query:

source="dogecoin.log" AND ("CreateTransaction" OR "wallet access")

📊 Metadata

CVE ID: CVE-2021-37491

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Published: February 7, 2023

Last Updated: March 25, 2025

🔗 References

http://dogecoin.com Product
https://github.com/VPRLab/BlkVulnReport/blob/main/NDSS23_BlockScope.pdf Exploit,Technical Description
https://github.com/bitcoin/bitcoin/commit/2fb9c1e6681370478e24a19172ed6d78d95d50d3 Patch
https://github.com/dogecoin/dogecoin/blob/master/src/wallet/wallet.cpp#L2628-L2640 Exploit
https://github.com/dogecoin/dogecoin/issues/2279 Issue Tracking,Patch
http://dogecoin.com Product
https://github.com/VPRLab/BlkVulnReport/blob/main/NDSS23_BlockScope.pdf Exploit,Technical Description
https://github.com/bitcoin/bitcoin/commit/2fb9c1e6681370478e24a19172ed6d78d95d50d3 Patch
https://github.com/dogecoin/dogecoin/blob/master/src/wallet/wallet.cpp#L2628-L2640 Exploit
https://github.com/dogecoin/dogecoin/issues/2279 Issue Tracking,Patch

📤 Share & Export

📄 Export Markdown 📋 Export JSON