CVE-2024-32647

Double eval vulnerability in Vyper's `create_from_blueprint` function.

• CVSS 5.3
• CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
• Design Defects
• Remote

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist.

CVE

CVE-2024-32647

CWE

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CVSS base score

5.3

Published

2024-04-25

OWASP

A01 Broken Access Control

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Vyper

Fixed by upgrading

Yes

Solution

Upgrade to Vyper version 0.3.11 or later, once available.

@public
@constant
def create_from_blueprint(raw_args: bool, args: list) -> address:
    if raw_args:
        return build_create_IR(args)

def build_create_IR(args: list) -> address:
    return create_new_contract(args)

@public
@constant
def create_from_blueprint(raw_args: bool, args: list) -> address:
    assert isinstance(raw_args, bool), "raw_args must be a boolean"
    assert isinstance(args, list), "args must be a list"
    if raw_args:
        return build_create_IR(args)
    return ZERO_ADDRESS

def build_create_IR(args: list) -> address:
    assert all([is_bytes32(arg) for arg in args]), "All args must be bytes32"
    return create_new_contract(args)

# Example payload to exploit the double eval vulnerability

# A function that has a side effect
def side_effect_function():
    global state_variable
    state_variable += 1  # Modify a global variable

# Arguments list that includes a call to the side effect function
args_with_side_effects = [side_effect_function(), another_value]

# Call the vulnerable function with raw_args set to True
create_from_blueprint(True, args_with_side_effects)

@misc{vaitp:cve202432647,
  title        = {{Double eval vulnerability in Vyper's `create_from_blueprint` function.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-32647},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-32647/}}
}