CVE-2018-6353: OS Command Injection

Q: Who is exposed to this issue?

Users of Electrum through 2.9.4 and Electrum 3.x through 3.0.5 are exposed if an attacker can cause Python code to be pasted into the application's Python console. This includes users targeted through social engineering and unattended workstations accessible to someone physically nearby.

Q: What does an attacker need to do to exploit it?

The attacker needs code to be pasted into the Electrum Python console. The code can install hook code that executes later, after the wallet password has been entered, enabling theft of Bitcoin.

Q: Is user interaction required?

No explicit interaction is required by the CVSS vector once the attacker has the necessary local access and can paste code into the console. In a social-engineering scenario, the victim may paste code they do not understand; in a physical-access scenario, the attacker can paste it at an unattended workstation.

Q: How can exposure be reduced if updating is not immediately possible?

Do not paste untrusted or unreviewed code into the Electrum Python console. Prevent unauthorized physical access to unattended workstations, especially where an Electrum wallet may later be unlocked.

Published Jan 27, 2018

Updated

The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering attacks in which a user pastes code that they do not understand and (2) code pasted by a physically proximate attacker at an unattended workstation, which makes it easier for attackers to steal Bitcoin via hook code that runs at a later time when the wallet password has been entered, a different vulnerability than CVE-2018-1000022.

Affected Software

6 affected components

Electrum Electrum<=2.9.4

Electrum Electrum=3.0.0

Electrum Electrum=3.0.1

Electrum Electrum=3.0.2

Electrum Electrum=3.0.3

Electrum Electrum=3.0.5

Event History

Jan 27, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·03:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Users of Electrum through 2.9.4 and Electrum 3.x through 3.0.5 are exposed if an attacker can cause Python code to be pasted into the application's Python console. This includes users targeted through social engineering and unattended workstations accessible to someone physically nearby.

What does an attacker need to do to exploit it?

The attacker needs code to be pasted into the Electrum Python console. The code can install hook code that executes later, after the wallet password has been entered, enabling theft of Bitcoin.

Is user interaction required?

No explicit interaction is required by the CVSS vector once the attacker has the necessary local access and can paste code into the console. In a social-engineering scenario, the victim may paste code they do not understand; in a physical-access scenario, the attacker can paste it at an unattended workstation.

How can exposure be reduced if updating is not immediately possible?

Do not paste untrusted or unreviewed code into the Electrum Python console. Prevent unauthorized physical access to unattended workstations, especially where an Electrum wallet may later be unlocked.

CVE-2018-6353: OS Command Injection

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is user interaction required?

How can exposure be reduced if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is user interaction required?

How can exposure be reduced if updating is not immediately possible?