First Flight #6: Voting Booth

Summary

The VotingBoothTest.t.sol test suite includes a function named testPwned, which executes arbitrary commands on the user's machine. This presents a significant security risk, as such commands could potentially extract sensitive data, establish a reverse shell for remote control, search for passwords, or install malware.

Vulnerability Details

This is the malicious test, it looks inoffensive as it just create a file called youve-been-pwned-remember-to-turn-off-ffi! but there is no underlying reason for this test to be here except a malicious behavior.

A more alarming scenario is demonstrated in the following proof of concept, where the user's API key could be compromised:.

First export the api key in your shell

Then execute the test to store the API key in a file:

Alternatively, transmit it to an external server:

Other interesting POC that qualify this issue as a HIGH.

POC 1: Reverse Shell Using Netcat.
This POC demonstrates how a test could open a reverse shell, allowing an attacker to gain control over the user's machine.

POC 2: Finding Files and Sending Results to a Server.
This POC shows how a test could find specific files (starting with "pass" ) and send the results to a remote server.

POC 3: Destructive Command (rm -rf /).
This POC demonstrates a highly destructive command that could potentially erase all data on the user's root filesystem.

Warning: This command is extremely harmful and should never be executed.

Important Disclaimer: The rm -rf / command will delete everything on the filesystem for which the user has write permissions. It is provided here strictly for educational purposes to demonstrate the severity of security vulnerabilities in scripts and should never be run on any system.

Impact

This issue is categorized as HIGH due to the direct risk it poses to funds and sensitive information.
The test, as it stands, is harmful, as it is used in a security contexts but I assume that the general purpose of this functionality is to be harmfull.
It could lead to data breaches (including private keys and passwords), unauthorized remote code execution, and the potential destruction of digital information (e.g., rm -rf /).

Tools Used

Forge test

Recommendations

Always exercise caution before running third-party programs on personal system. Ensure you understand the functionality of any command or script to prevent unintended consequences, especially those involving security vulnerabilities.