Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/klever-io/klever-go | go | < 1.7.19 | 1.7.19 |
Miggo AIRoot Cause AnalysisThe analysis started by examining the provided commit 8bcc600b0ac88070740c63c7ce1c8a968dd85251, which contains the fix for the vulnerability. The commit message explicitly mentions a fix for an SFT add-quantity integer overflow. The patch for core/kapp/systemAccount/systemAcount.go clearly shows the addition of an overflow check after the line meta.Circulation += amount in the SFTAddCirculation function. This identifies SFTAddCirculation as a vulnerable function, as it performs an arithmetic operation without proper validation, leading to an integer overflow. The vulnerability description further specifies that the malicious input is supplied through the processSemiFungibleAddQuantity function in core/kapp/kda/mint.go. Although this file was not modified in the provided patch, the description strongly indicates that this function is the entry point for the exploit, processing the malicious input. Therefore, both processSemiFungibleAddQuantity (as the input handler) and SFTAddCirculation (as the point of the overflow) are identified as the vulnerable functions.
systemAccountKApp.SFTAddCirculationcore/kapp/systemAccount/systemAcount.go
kdaKapp.processSemiFungibleAddQuantitycore/kapp/kda/mint.go