CVE-2022-25335 : RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultiple

RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.

Published 2022-02-18 18:15:13

Updated 2022-03-01 01:24:19

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-25335

Rigoblock » Drago
Versions up to, including, (<=) 2022-02-17
cpe:2.3:a:rigoblock:drago:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-25335

EPSS FAQ

0.35%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-25335

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2022-25335

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-25335

https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8

Attention Required! | Cloudflare
Product;Third Party Advisory
https://twitter.com/RigoBlock/status/1494351180713050116

RigoBlock on Twitter: "RigoBlock has been hacked. All tokens in Dragos but ETH and USDT are at risk due to an exploited protocol vulnerability. The fix will require a major protocol upgrade, please do
Exploit;Issue Tracking;Third Party Advisory
https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1f

Attention Required! | Cloudflare
Third Party Advisory
https://raw.globalsecuritydatabase.org/GSD-2022-1000077

Exploit;Third Party Advisory
https://twitter.com/danielvf/status/1494317265835147272

Daniel Von Fange on Twitter: "Drago just got Rekt https://t.co/krFEdPM9Cw" / Twitter
Exploit;Issue Tracking;Third Party Advisory

Jump to

Vulnerability Details : CVE-2022-25335

Products affected by CVE-2022-25335

Exploit prediction scoring system (EPSS) score for CVE-2022-25335

CVSS scores for CVE-2022-25335

CWE ids for CVE-2022-25335

References for CVE-2022-25335