Arbitary commands ran on host
Summary
Arbitary commands are allowed to run on host's machine. This leads to possible malware.
Vulnerability Details
Foundry cheatcode ffi is enabled, which allows arbitary commands to run on host's machine. The testPwned test allows creating of a file on host's machine.
Impact
Creation of empty file.
Tools Used
Manual review
Recommendations
Disable ffi by setting ffi=false in foundry.toml
Lead Judging Commences
test_pwned FFI vulnerability
The FFI variable within Foundry.TOML was set to TRUE. This variable gives foundry shell access and allows it to run commands on your terminal. The possibility of exploitation through this means are endless! This repo exploited this flag through test_pwned Keep an eye out before running tests!
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.