AlphaWallet / AlphaWallet/alpha-wallet-android

Crash: A malicious NFT can make app crash.

Abierto
#2,685 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Java
Estrellas
646
Forks
579
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

**Bug Description**
A malicious NFT can make alphawallet(adnroid) crash due to missing parameter validation . if an attacker send a Nft token to a alphawallet address, alphawallet will auto load the nft info in wallet .

step to reproduce:

1.deploy a NFT contract.

2.send a Nft token to any alphawallet user with a malicious tokenUri

3.user open the wallet app ,and click Nft item

4.app will crash.

or you can use this test mnemonic Phrase (ropsten)

`federal smile danger mixed palace equal intact wood goat digital patrol relax`

**Impact**
1.make app crash.

2.Let users have a lot of dirty data in their wallets .

you can view this video: https://www.ghostmaze.top/aw/nft_crash.mp4

tx:0xf1f1bf469d43279d4df81b9e66135054b327fae089122b2bde12b5060b7eb3eb (ropsten)

**Vulnerability Analysis**
`alpha-wallet-android-master\app\src\main\java\com\alphawallet\app\widget\NFTImageView.java`
loadImage funtion can load the Nft token metainfo from any website.

```
private void loadImage(String url, String backgroundColor, int corners) throws IllegalArgumentException
{
if (!Utils.stillAvailable(getContext())) return;

setWebViewHeight((int)getLayoutParams().width);

this.imageUrl = url;
fallbackLayout.setVisibility(View.GONE);
image.setVisibility(View.VISIBLE);
webLayout.setVisibility(View.GONE);

if (!TextUtils.isEmpty(backgroundColor))
{
int color = Color.parseColor("#" + backgroundColor);
ColorStateList sl = ColorStateList.valueOf(color);
holdingView.setBackgroundTintList(sl);
}
else
{
holdingView.setBackgroundColor(ContextCompat.getColor(getContext(), R.color.transparent));
}

loadRequest = Glide.with(getContext())
.load(url)
.transform(new CenterCrop(), new RoundedCorners(corners))
.transition(withCrossFade())
.override(Target.SIZE_ORIGINAL)
.timeout(30 * 1000)
.listener(requestListener)
.into(new DrawableImageViewTarget(image)).getRequest();
}
```
when parse Nft BackgroundColor filed from metainfo, due to missing parameter validation , any malicious data can enter the function.

`int color = Color.parseColor("#" + backgroundColor);`
and in parseColor function , it will use parseLong() to parse backgroundColor parameter , if backgroundColor is not correct , it will crash . look like this:

`at java.lang.NumberFormatException.forInputString(NumberFormatException.java:65)`

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.