CVE-2020-10937

CVE-2020-10937 affects go-ipfs version 0.4.23. The vulnerability allows an attacker to generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison the routing tables of other nodes. This eclipses the targeted nodes, isolating them from the rest of the network. [1]

An attacker can exploit this by creating a large number of pseudonymous Peer IDs, which are used to subvert the libp2p reputation system. The attack manipulates the targeted node's DHT routing table so that only attacker-controlled peers are present. No authentication or prior access is required, as the attack is performed externally over the network. [2]

The impact of a successful eclipse attack is that the victim node is effectively cut off from legitimate peers. The attacker can then censor or manipulate the content that the targeted node can retrieve, and may be able to conduct further attacks such as routing or data injection. The vulnerability is rated with a critical CVSS score. [1]

Mitigations were released incrementally in go-ipfs versions 0.5, 0.6, and 0.7, with version 0.7 fully mitigating the original attack. The fix involved hardening the DHT routing and raising the cost of Sybil attacks. Users should upgrade to go-ipfs 0.7 or later. [2]