First Flight #6: Voting Booth

Summary

The testPwned() method in the tests will run 'touch youve-been-pwned-remember-to-turn-off-ffi!' in your system.

Vulnerability Details

The project has FFI enabled which allows Foundry to execute arbitrary system commands. This poses a large security risk as it could allow users who run these tests to potentially execute malicious code without realising it. In this case it is simple making an empty file, but could also be something much worse.

Impact

Potentially compromising the security of users who run tests.

Tools Used

Foundry

Recommendations

Disable FFI in foundry.toml and remove the testPwned() test.