{"id":"GHSA-j47c-j42c-mwqq","summary":"Solana Pay Vulnerable to Weakness in Transfer Validation Logic","details":"### Description\nWhen a Solana Pay transaction is located using a [reference key](https://github.com/solana-labs/solana-pay/blob/master/SPEC.md#reference), it may be checked to represent a transfer of the desired amount to the recipient, using the supplied [`validateTransfer` function](https://github.com/solana-labs/solana-pay/blob/master/core/src/validateTransfer.ts). An edge case regarding this mechanism could cause the validation logic to validate multiple transfers.\n\n### Impact\nMost known Solana Pay point of sale applications are currently run on physical point of sale devices, which makes this issue unlikely to occur. However, there may be web-based point of sale applications using the protocol where it may be more likely to occur.\n\n### Patches\nThis issue has been patched as of version [`0.2.1`](https://www.npmjs.com/package/@solana/pay/v/0.2.1). Users of the Solana Pay SDK should upgrade to it.","aliases":["CVE-2022-35917"],"modified":"2023-11-08T04:09:52.493322Z","published":"2022-08-06T05:39:18Z","database_specific":{"github_reviewed_at":"2022-08-06T05:39:18Z","nvd_published_at":"2022-08-01T22:15:00Z","cwe_ids":["CWE-670"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/solana-labs/solana-pay/security/advisories/GHSA-j47c-j42c-mwqq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35917"},{"type":"WEB","url":"https://github.com/solana-labs/solana-pay/commit/ac6ce0d0a81137700874a8bf5a7caac3be999fad"},{"type":"PACKAGE","url":"https://github.com/solana-labs/solana-pay"},{"type":"WEB","url":"https://github.com/solana-labs/solana-pay/blob/master/SPEC.md#reference"},{"type":"WEB","url":"https://github.com/solana-labs/solana-pay/blob/master/core/src/validateTransfer.ts"}],"affected":[{"package":{"name":"@solana/pay","ecosystem":"npm","purl":"pkg:npm/%40solana/pay"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 0.2.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-j47c-j42c-mwqq/GHSA-j47c-j42c-mwqq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}