First Flight #1: PasswordStore
First Flight #1
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Any person can change the password

bronzepickaxe

Summary

Due to a lack of modifier, every person is able to change s_password, resulting in overriding the password set in s_password.

Vulnerability Details

PasswordStore.sol acts as Password Manager, where a user should be able to safely store his password. A user could set this password using the setPassword function, which updates the s_password variable:

function setPassword(string memory newPassword) external {
s_password = newPassword;
emit SetNetPassword();
}

However, this function lacks access control. Concretely, every person is able to call this function, resulting in changing the s_password variable.

I wrote this PoC to showcase this, put it into PasswordStore.sol:

function test_malicious_password_setter() public {
// Set password to "myNewPassword" and check if it's equal to "myNewPassword"
vm.startPrank(owner);
string memory expectedPassword = "myNewPassword";
passwordStore.setPassword(expectedPassword);
string memory actualPassword = passwordStore.getPassword();
assertEq("myNewPassword", expectedPassword);
vm.stopPrank();
​
// Malicious user changes passwoord to 'pwned' and prank into owner and see if the password has been changed.
address malicious_user = makeAddr("hacker");
vm.prank(malicious_user);
passwordStore.setPassword("pwned");
vm.prank(owner);
string memory hackedPassword = passwordStore.getPassword();
assertEq("pwned", hackedPassword);
}

Impact

The lack of access control breaks the core functionality of the project, which is being a Password Manager.

Tools Used

Manual review

Recommendations

Add the following check in the setPassword function:

function setPassword(string memory newPassword) external {
+ if (msg.sender != s_owner) {
+ revert PasswordStore__NotOwner();
+ }
s_password = newPassword;
emit SetNetPassword();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-lacking-access-control

Anyone can call `setPassword` and set a new password contrary to the intended purpose.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.