Vulnerability in Trustwallet Trust Wallet Browser Extension
CVE-2023-31290
Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input seed, resulting in only four billion possible mnemonics. The affected versions of the browser extension are 0.0.172 through 0.0.182. To steal funds efficiently, an attacker can identify all Ethereum addresses created since the 0.0.172 release, and check whether they are Ethereum addresses that could have been created by this extension. To respond to the risk, affected users need to upgrade the product version and also move funds to a new wallet address.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.010 (62.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 62.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- community.trustwallet.com/t/browser-extension-wasm-vulnerability-postmortem/750… (Vendor Advisory)
- community.trustwallet.com/t/wasm-vulnerability-incident-update-and-recommended-… (Vendor Advisory)
- github.com/trustwallet/wallet-core/compare/3.1.0...3.1.1 (Patch)
- twitter.com/TrustWallet/status/1649699428733947906 (Third Party Advisory)
- blog.ledger.com/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-ext… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-31290?
- CVE-2023-31290 is a medium-severity vulnerability in Trustwallet Trust Wallet Browser Extension, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 5.9/10. Published 2023-04-27.
- How severe is CVE-2023-31290?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2023-31290 known to be exploited?
- 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.