Nonfungible token marketplace OpenSea has reportedly patched a vulnerability that, if exploited, could have exposed identifying information about its anonymous users.Â
In a March 9 blog post blog, cybersecurity firm Imperva detailed how it discovered the vulnerability, which it claimed could deanonymize OpenSea users âby linking an IP address, a browser session, or an email in certain conditionsâ to an NFT.
As the NFT corresponds to a cryptocurrency wallet address, a userâs real identity could be revealed from the information gathered and linked to the wallet and its activity, Imperva explained.
Imperva Red Team discovered a cross-site search vulnerability affecting the #NFT marketplace #OpenSea.
This vulnerability allows for the deanonymization of users, potentially revealing a user’s identity. https://t.co/nGQWceeGEc
— Imperva (@Imperva) March 9, 2023
The exploit is understood to have taken advantage of a cross-site search vulnerability. Imperva claimed OpenSea had misconfigured a library that resizes webpage elements that load HTML content from elsewhere that are typically used to place ads, interactive content, or embedded videos.
As OpenSea didnât restrict this libraryâs communications, exploiters could use the information it broadcasts as an âoracleâ to narrow down when searches return no results as the webpage would be smaller.
Imperva detailed that an attacker would send their target a link through email or SMS, which if clicked âreveals valuable information, such as the targetâs IP address, user agent, device details, and software versions.â
The attacker would then use OpenSeaâs vulnerability to extract the NFT names of their target and associate the corresponding wallet address with identifying information such as an email or phone number which was sent the original link.
Imperva said OpenSea âquickly addressed the issueâ and properly restricted the libraryâs communications, reporting that the platform âwas no longer at risk of such attacks.â
Related: Security team creates dashboard to detect potential NFT hacks in OpenSea
Users of the platform have long been victims of attacks that mimic OpenSeaâs functions to undertake exploits, such as phishing websites that resemble the platform or signature requests appearing to originate from OpenSea.
OpenSea itself has faced criticism for its platform security due to a major phishing attack in February 2022 that resulted in over $1.7 million worth of NFTs being stolen from users.
As for the recent patch, itâs unknown how long it existed or if any users had been affected by the exploit.
OpenSea did not immediately respond to Cointelegraphâs request for comment.
