Disclosure of crash using malicious BIP72 URI

Bitcoin-Qt could crash upon opening a BIP72 URI.

This issue is considered Medium severity.

Details

BIP72 extends the BIP21 URI scheme
with an r parameter to fetch a payment request from. An attacker could simply point the URL
contained in the r parameter to a very large file, for which Bitcoin-Qt would try to allocate
enough memory and crash.

The victim could get tricked into opening a rogue payment request. The large download would happen
in the background with little to no output in the GUI until the application runs out of memory.

Attribution

Credits go to Michael Ford (Fanquake) for responsibly disclosing the issue and providing a PoC.

Timeline

2019-08-12 Michael Ford reports the bug to Cory Fields and Wladimir Van Der Laan
2019-10-16 Michael Ford opens PR #17165 to get rid of BIP70 support entirely
2019-10-26 Michael’s PR is merged into Bitcoin Core
2020-06-03 Bitcoin Core version 0.20.0 is released
2021-09-13 The last vulnerable Bitcoin Core version (0.19.x) goes EOL
2024-07-03 Public disclosure