First Flight #6: Voting Booth

Summary

The test file include a dangerous test that in combination with ffi set to true in the foundry.toml file, allows to breach the of the equipment of security reviewers and make potential read/write operations on their system.

Vulnerability Details

The test file contains the following malicious code:

This test will run the touch bash command and will create a file with the name youve-been-pwned-remember-to-turn-off-ffi!. Although this is harmless and was intentionally inserted for educational purposes, in a more realistic scenario the test could include dangerous code that will breach the security of the equipment and steal/read/destroy sensitive data.

Tools Used

Manual verification.

Recommendations

Before building and running code always read the codebase to know if it's safe to run and check the config files to see what options are set.