Snowman Merkle Airdrop
First Flight #42
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Path Traversal Risk

fredopapi7

Root + Impact

Description

  • The script writes generated JSON to a predefined path (/script/flakes/input.json) for test data consumption.

  • Hardcoded INPUT_PATH enables directory escape sequences, allowing arbitrary file overwrite if path contains ../.

string private constant INPUT_PATH = "/script/flakes/input.json"; // @> Vulnerable path definition
​
vm.writeFile(string.concat(vm.projectRoot(), INPUT_PATH), input); // @> Unsafe write operation

Risk

Likelihood:

  • Reason 1 // High during CI/CD execution with user-controllable inputs

  • Reason 2 // Certain when integrating with external systems

  • Reason 3 // Guaranteed if project root is writable to attackers

Impact:

  • Impact 1 Permanent deletion of critical system files

  • Impact 2 Remote code execution via config file tampering

  • Impact 3 Complete CI/CD pipeline compromise

Proof of Concept

# Malicious test configuration
INPUT_PATH="../../../../etc/crontab"
​
# Resulting write path:
# /project/root/../../../../etc/crontab → /etc/crontab

Recommended Mitigation

- string private constant INPUT_PATH = "/script/flakes/input.json";
+ string private constant RELATIVE_PATH = "script/flakes/input.json";
​
function run() public {
+ string memory path = string.concat(vm.projectRoot(), "/", RELATIVE_PATH);
+ require(!_isPathTraversal(path), "Invalid path");
- vm.writeFile(string.concat(vm.projectRoot(), INPUT_PATH), input);
+ vm.writeFile(path, input);
}
​
+ function _isPathTraversal(string memory path) internal pure returns (bool) {
+ bytes memory b = bytes(path);
+ for (uint i; i < b.length - 2; i++) {
+ if (b[i] == "." && b[i+1] == "." && b[i+2] == "/") return true;
+ }
+ return false;
+ }
Updates

Lead Judging Commences

yeahchibyke Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.