HackerOne Disclosed Reports - 2025-05-23

Medium
resolved

WASI sandbox escape via symlink

Bug reported by Jesse Wilson was disclosed at May 24, 2025, 10:33 am   |   Privilege Escalation

A WASI + WASM program was discovered to be able to use `path_symlink` to read arbitrary files on the host machine by creating a symlink in a preopen to a different location on the local file system, thereby escaping the WASI sandbox.

Low
resolved

Dynamic fee algorithm doesn't check for zero fee

Bug reported by sech1 was disclosed at May 23, 2025, 2:25 pm   |   Uncontrolled Resource Consumption

The dynamic fee algorithm in the Monero blockchain did not properly check for a zero fee, which could have allowed an attacker to flood the network with transactions at no cost, potentially leading to unlimited blockchain growth.

Medium
resolved

RPC service DOS

Bug reported by ptrstr was disclosed at May 23, 2025, 2:25 pm   |   Uncontrolled Resource Consumption

The RPC service running on port 18081 (or 28081, 38081) was vulnerable to a denial-of-service attack due to a loop iterating until the maximum range of a 64-bit unsigned integer. The vulnerability was present in all versions after the commit b030f207517f59a5122409398549a02ac23829ae, up to and including version 0.18.3.1.