CVE-2024-27094: 
JavaScript vulnerability analysis and mitigation

OpenZeppelin Contracts, a library for secure smart contract development, disclosed a vulnerability (CVE-2024-27094) in its Base64.encode function. The vulnerability was discovered in versions >=4.5.0 <5.0.2 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable packages. The issue was reported by Independent Security Researcher Riley Holterhus through Immunefi and has been fixed in versions 5.0.2 and 4.9.6 (GitHub Advisory).

The Base64.encode function processes bytes input by iterating over it in chunks of 3 bytes. When the input length is not a multiple of 3, the last iteration may read memory beyond the input buffer. Although the function implements padding for these cases, up to 4 bits of data are retained between the encoding and padding stages. If the memory after the input contains non-zero values (dirty memory), these bits can corrupt the output. This issue is more likely to occur when either a bytes memory struct with non-zero initial bytes is allocated immediately after the input, or when the memory pointer is set to a non-empty memory location before allocating the input (GitHub Advisory).

The vulnerability has been rated as LOW severity. While the issue can lead to corrupted Base64 encoding output when specific memory conditions are met, the impact is limited to scenarios where the extra bits can be maliciously manipulated by an attacker (GitHub Advisory).

The vulnerability requires specific conditions to be exploitable, particularly when dealing with input lengths that are not multiples of 3 bytes and when there is dirty memory present after the input buffer. The issue was discovered and reported through Immunefi's bug bounty program (GitHub Advisory).

The vulnerability has been patched in versions 5.0.2 and 4.9.6 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable packages. Users are advised to upgrade to these versions to address the issue (GitHub Advisory).