GHSA-m3rh-cvr5-x6q4: 
vulnerability analysis and mitigation

A low severity vulnerability (GHSA-m3rh-cvr5-x6q4) was discovered in wasmd versions prior to 0.52.0, affecting multiple message types where it was possible to add a large number of addresses leading to unexpected resource consumption in ValidateBasic. The vulnerability was discovered by Richie and reported through the Cosmos Bug Bounty Program on HackerOne (CosmWasm Advisory).

The vulnerability affects multiple wasmd message types that call assertValidAddresses via AccessConfig.ValidateBasic() to ensure address format and uniqueness. An attacker could provide numerous addresses in AccessConfig.Addresses and specify AccessConfig.Permission as AccessTypeAnyOfAddresses. The affected message types include MsgStoreAndInstantiateContract, MsgStoreAndMigrateContract, MsgStoreCode, MsgUpdateInstantiateConfig, MsgUpdateParams, MsgAddCodeUploadParamsAddresses, and MsgRemoveCodeUploadParamsAddresses. The number of addresses a malicious actor can insert is limited by the gas charged for transaction sizes and the block size limit (CosmWasm Advisory).

The vulnerability could lead to large memory consumption in the map, increased address validation efforts, and a slowdown of map operations. The severity is classified as Low with Moderate impact and Unlikely likelihood according to Amulet's Severity Classification Framework (GitHub Advisory).

The vulnerability has a CVSS v4.0 base score of 6.3 (Moderate) with Network attack vector, High attack complexity, and No privileges required for exploitation (GitHub Advisory).

The vulnerability was patched in wasmd version 0.52.0 by implementing a new unified validateBech32Addresses function that replaces assertValidAddresses and checkDuplicatedAddresses. The patch includes checks for minimum and maximum element count, address validity, and uniqueness. Users should upgrade to wasmd 0.52.0 or higher, or alternatively backport the patch from CosmWasm/wasmd#1926 (CosmWasm Advisory).