Vulnerability in Astroxnetwork Agent Dart
CVE-2024-48915
Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation` function, the canister_ranges aren't verified. The impact of not checking the canister_ranges is that a subnet can sign canister responses in behalf of another subnet. The certificate’s timestamp, i.e /time path, is also not verified, meaning that the certificate effectively has no expiration time. Version 1.0.0-dev.29 implements appropriate certificate verification.
Vulnerability class: Improper Certificate Validation
EPSS: 0.004 (29.5th percentile) — read the EPSS interpretation.
Affected products
- Astroxnetwork Agent_dart — versions < 1.0.0-dev.29
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-48915?
- CVE-2024-48915 is a vulnerability in Astroxnetwork Agent Dart, classified under Improper Certificate Validation. Published 2024-10-15.
- Is CVE-2024-48915 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.