« Volver al listado

CVE-2025-32965

Estado: AplazadaCrítica (9.3)—

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch.

Leer descripción completaMostrar menos

To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Ataque de cadena de suministro: versiones comprometidas de xrpl.js contienen código malicioso para exfiltración de claves privadas. CWE-506 (código embedded malicioso) y distribución en repositorio público confirman T1195.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account ManagementApplication Developer GuidanceVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Software Installation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Xrpl — Xrpl.jsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32965",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32965",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T13:23:25.246539Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "XRPLF",
          "product": "xrpl.js",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.2.1, < 4.2.5"
            },
            {
              "status": "affected",
              "version": "= 2.14.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-22T21:15:45.503",
  "references": [
    {
      "url": "https://github.com/XRPLF/xrpl.js/security/advisories/GHSA-33qr-m49q-rxfx",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/assign-a-regular-key-pair",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://xrpl.org/docs/tutorials/how-tos/manage-account-settings/disable-master-key-pair",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-506"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Version 2.14.2 is also malicious, though it is less likely to lead to exploitation as it is not compatible with other 2.x versions. Anyone who used one of these versions should stop immediately and rotate any private keys or secrets used with affected systems. Users of xrpl.js should pgrade to version 4.2.5 or 2.14.3 to receive a patch. To secure funds, think carefully about whether any keys may have been compromised by this supply chain attack, and mitigate by sending funds to secure wallets, and/or rotating keys. If any account's master key is potentially compromised, disable the key."
    },
    {
      "lang": "es",
      "value": "xrpl.js es una API de JavaScript/TypeScript para interactuar con el Libro Mayor de XRP en Node.js y el navegador. Las versiones 4.2.1, 4.2.2, 4.2.3 y 4.2.4 de xrpl.js fueron comprometidas y contenían código malicioso diseñado para exfiltrar claves privadas. La versión 2.14.2 también es maliciosa, aunque es menos probable que resulte en explotación, ya que no es compatible con otras versiones 2.x. Cualquiera que haya usado una de estas versiones debe detener su uso inmediatamente y rotar las claves privadas o secretos utilizados en los sistemas afectados. Los usuarios de xrpl.js deben actualizar a la versión 4.2.5 o 2.14.3 para recibir un parche. Para proteger los fondos, considere cuidadosamente si alguna clave pudo haber sido comprometida por este ataque a la cadena de suministro y mitigue el riesgo enviando fondos a billeteras seguras o rotando las claves. Si la clave maestra de alguna cuenta está potencialmente comprometida, desactívela."
    }
  ],
  "lastModified": "2026-06-17T09:12:52.603",
  "sourceIdentifier": "security-advisories@github.com"
}