Chia Blockchain RPC Auth Bypass, CSRF, and Master Passphrase Bypass Analysis

Critical Vulnerability Information Title Chia Network Chia Blockchain 2.1.0 (confirmed vulnerable) Later versions (2.2.0 - 2.5.6) presumed vulnerable - no fix released Authentication Bypass/CSRF/Cryptographic Issue Description The Chia RPC server (rpc_server_base.py) contains multiple critical vulnerabilities: 1. Authentication Bypass: If RPC credentials are not set (default configuration), returns True for all requests. 2. CSRF: No CORS headers or origin validation. Malicious websites can send POST requests to localhost:9256/8555; although browsers block reading the response, the wallet will still execute the commands. 3. Master Password Bypass: The RPC server ignores the wallet's locked state. Any local process with access to the mTLS certificate can invoke and without a password, returning the 24-word seed in plaintext. Impact Remote theft of funds via CSRF + DNS redirection Local malware can drain the wallet and steal the seed without requiring a password Full account takeover Additional Information Reported to Chia Network via HackerOne (#3524400). The vendor marked it as "Informational," noting: "This is by design. Users are responsible for host security." No CVE assigned. Full documentation and PoC video are available. Details Source: https://github.com/DanilLzg/chia-rpc-auth-bypass.git User: DeSneake (UID 95539) Submission: February 12, 2022, 2:13 PM Review Time: February 25, 2022, 10:35 AM (13 days later) Status: Accepted VulDB Entry: 347750 [Chia Blockchain 2.1.0 RPC Server Master Passphrase send_transaction/get_private_key missing authentication]

Goal Reached Thanks to every supporter — we hit 100%!

Chia Blockchain RPC Auth Bypass, CSRF, and Master Passphrase Bypass Analysis