ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2024-48915

Agent Dart is missing certificate verification checks

Published Oct 15, 2024 · catalog updated Oct 15, 2024 · Agent Dart is missing

Check if you run it

No confirmed exploitation is on record for CVE-2024-48915. EPSS is 0.37%. Act only if a listed version of Agent Dart is missing is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Agent Dart is missing).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
None0.0
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.37%
Remediation
Advisory link
Affected products
Pub agent_dart

Certificate verification (in [lib/agent/certificate.dart](https://github.com/AstroxNetwork/agent_dart/blob/main/lib/agent/certificate.dart)) has been found to contain two issues: - During the delegation verification (in [_checkDelegation](https://github.com/AstroxNetwork/agent_dart/blob/f50971dfae3f536c1720f0084f28afbcf5d99cb5/lib/agent/certificate.dart#L162) function) the canister_ranges aren't verified. The impact of not checking the canister_ranges is that a subnet can sign canister responses in behalf of another subnet. You have more details in the IC specification [here](https://internetcomputer.org/docs/current/references/ic-interface-spec#certification-delegation). Also for reference you can check how is this implemented in [the agent-rs](https://github.com/dfinity/agent-rs/blob/608a3f4cfdcdfc5ca1ca74a1b9d33f2137a2d324/ic-agent/src/agent/mod.rs#L903-L914). - The certificate’s timestamp, i.e /time path, is not verified, meaning that the certificate effectively has no expiration time. The [IC spec](https://internetcomputer.org/docs/current/references/ic-interface-spec#http-query) doesn’t specify an expiry times, it gives some suggestions, quoting: "A reasonable expiry time for timestamps in R.signatures and the certificate Cert is 5 minutes (analogously to the maximum allowed ingress expiry enforced by the IC mainnet). Delegations require expiry times of at least a week since the IC mainnet refreshes the delegations only after replica upgrades which typically happen once a week". For reference you can check how is this implemented in the agent-rs ([here](https://github.com/dfinity/agent-rs/blob/608a3f4cfdcdfc5ca1ca74a1b9d33f2137a2d324/ic-agent/src/agent/mod.rs#L820) and [here](https://github.com/dfinity/agent-rs/blob/608a3f4cfdcdfc5ca1ca74a1b9d33f2137a2d324/ic-agent/src/agent/mod.rs#L876-L887)). **Additionally**, seems [replica signed queries](https://internetcomputer.org/blog/features/replica-signed-queries) aren’t implemented

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Pub agent_dart0 → 1.0.0-dev.29

How to fix CVE-2024-48915

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2024-48915. EPSS is 0.37%. Act only if a listed version of Agent Dart is missing is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.0.0-dev.29. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-295: Improper Certificate Validation; CWE-347: Improper Verification of Cryptographic Signature. EPSS 0.37%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2024 · GitHub Advisory Database

    Detected

    Certificate verification (in [lib/agent/certificate.dart](https://github.com/AstroxNetwork/agent_dart/blob/main/lib/agent/certificate.dart)) has been found to contain two issues: - During the delegation verification (in [_checkDelegation](https://github.com/AstroxNetwork/agent_dart/blob/f50971dfae3f536c1720f0084f28afbcf5d99cb5/lib/agent/certificate.dart#L162) function) the canister_ranges aren't v

  2. Oct 15, 2024 · GitHub Advisory Database

    Fix available

    agent_dart fixed in 1.0.0-dev.29

  3. Oct 15, 2024 · GitHub Advisory Database

    Fix available

    agent_dart fixed in 1.0.0-dev.29

  4. Oct 15, 2024 · GitHub Advisory Database

    Updated

    Certificate verification (in [lib/agent/certificate.dart](https://github.com/AstroxNetwork/agent_dart/blob/main/lib/agent/certificate.dart)) has been found to contain two issues: - During the delegation verification (in [_checkDelegation](https://github.com/AstroxNetwork/agent_dart/blob/f50971dfae3f536c1720f0084f28afbcf5d99cb5/lib/agent/certificate.dart#L162) function) the canister_ranges aren't v

Sources

References

Freshness

Last verified in this catalog Oct 16, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.