CyberRota Analysis
AI-GeneratedThe vulnerability in ZenHive's mpp allows unauthenticated remote clients to exploit an authentication bypass by resubmitting previously settled on-chain transfers, enabling them to access paid resources without authorization. This flaw arises from the improper binding of transaction credentials, which permits an attacker to leverage historical transfers for unlimited subsequent charges. Organizations utilizing mpp versions from 0.3.0 to before 0.6.3 should prioritize patching this high-severity vulnerability to prevent unauthorized access and potential financial loss.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount (ERC-20) or to and value (native). It binds the proof neither to the challenge being verified nor to any record of prior use, and the generic MPP.Plug dedup store keys on challenge.id, which is regenerated for every 402 response. On a static-price route, a single historical transfer matching the charge therefore satisfies an unbounded number of later charges, including transfers an attacker can read off a public block explorer. This issue affects mpp: from 0.3.0 before 0.6.3.
Related CVEs
Other vulnerabilities affecting the same vendor(s)