First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

ffi is enabled and running commands on auditors' computers

aitor

Summary

Foreign Function Interface, aka ffi, is a cheat code that executes commands in our computer as if it were the owner. You should never run this type of test without knowing what is happening.

In this case, at the very moment we run make we run every test so, by default, we will be pwned!

Vulnerability Details (PoC)

After run clone and make:

➜ 2023-11-Santas-List git:(main) ✗ ls -la
total 112
drwxr-xr-x 17 aitor staff 544 Dec 6 09:46 .
drwxr-xr-x 16 aitor staff 512 Dec 6 09:45 ..
drwxr-xr-x 14 aitor staff 448 Dec 6 09:45 .git
drwxr-xr-x 3 aitor staff 96 Dec 6 09:45 .github
-rw-r--r-- 1 aitor staff 173 Dec 6 09:45 .gitignore
-rw-r--r-- 1 aitor staff 341 Dec 6 09:45 .gitmodules
-rw-r--r-- 1 aitor staff 1133 Dec 6 09:45 Makefile
-rw-r--r-- 1 aitor staff 33603 Dec 6 09:45 README.md
drwxr-xr-x 3 aitor staff 96 Dec 6 09:46 cache
-rw-r--r-- 1 aitor staff 543 Dec 6 09:45 foundry.toml
drwxr-xr-x 5 aitor staff 160 Dec 6 09:45 img
drwxr-xr-x 5 aitor staff 160 Dec 6 09:45 lib
drwxr-xr-x 38 aitor staff 1216 Dec 6 09:46 out
-rw-r--r-- 1 aitor staff 389 Dec 6 09:45 slither.config.json
drwxr-xr-x 5 aitor staff 160 Dec 6 09:45 src
drwxr-xr-x 4 aitor staff 128 Dec 6 09:45 test
-rw-r--r-- 1 aitor staff 0 Dec 6 09:46 youve-been-pwned
➜ 2023-11-Santas-List git:(main) ✗

:-( ups.

With the test testPwned() We run the instruction touch and have created the file youve-been-pwned

Impact

In this case, the elves were just being naughty, but a malicious developer could use this kind of test to control or destroy our computer.

Tools Used

Manual, foundry

Recommendations

Always check all code distributed by a customer, especially the tests. Then, if you find something suspicious, you can "comment" it and ask the developers for an explanation.

/*
* What is that???
​
function testPwned() public {
string[] memory cmds = new string[](2);
cmds[0] = "touch";
cmds[1] = string.concat("youve-been-pwned");
cheatCodes.ffi(cmds);
}
*/
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

test_pwned FFI vulnerability

The FFI variable within Foundry.TOML was set to TRUE. This variable gives foundry shell access and allows it to run commands on your terminal. The possibility of exploitation through this means are endless! This repo exploited this flag through test_pwned Keep an eye out before running tests!

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.