Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-1000023

CVE-2018-1000023:
Insight API transaction broadcast endpoint can result in Full Path Disclosure

5.3

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-1000023
GHSA ID
GHSA-8p2p-p8mg-x3cw
EPSS Score
0.4607%
CWE
CWE-20
Published
3/5/2018
Updated
1/9/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
insight-apinpm<= 5.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability manifests in the transaction broadcast flow starting from TxController.send (HTTP endpoint handler). The stack traces in disclosed errors explicitly show: 1) TxController.send at transactions.js:303 calling into 2) Bitcoin.sendTransaction at bitcoind.js:1806, which interacts with bitcoind-rpc. Both functions fail to validate() input properly before processing, allowing attackers to trigger path-disclosing errors through malformed 'rawtx' parameters. The direct correlation between the attack vector (web request to /tx/send) and these functions' error handling makes them clearly vulnerable.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*itp*y/insi**t-*pi Insi**t-*pi v*rsion *.*.* *n* **rli*r *ont*ins * *W*-**: input v*li**tion vuln*r**ility in tr*ns**tion *ro****st *n*point t**t **n r*sult in *ull P*t* *is*losur*. T*is *tt**k *pp**r to ** *xploit**l* vi* W** r*qu*st.

Reasoning

T** vuln*r**ility m*ni**sts in t** tr*ns**tion *ro****st *low st*rtin* *rom `Tx*ontroll*r.s*n*` (*TTP *n*point **n*l*r). T** st**k tr***s in *is*los** *rrors *xpli*itly s*ow: *) `Tx*ontroll*r.s*n*` *t `tr*ns**tions.js`:*** **llin* into *) `*it*oin.s*