Closed c4-bot-9 closed 8 months ago
raymondfam marked the issue as sufficient quality report
raymondfam marked the issue as primary issue
raymondfam marked the issue as duplicate of #167
rocketman-21 (sponsor) confirmed
MarioPoneder changed the severity to 3 (High Risk)
Partial credit due to having found 1/2 impact of primary issue.
MarioPoneder marked the issue as partial-50
Lines of code
https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/CultureIndex.sol#L209
Vulnerability details
Impact
CultureIndex allows users to upload any images/links which may become future Verbs. However there is no even an enforcement of the URL prefix, or any other validation, as in for example contractURI function. That means, that a malicious user may supply links such as:
javascript:eval(atob('YWxlcnQoJ3BvYycp'))
//(YWxlcnQoJ3BvYycp = alert('poc')) - a malicious script or redirect can be encoded hereIf such image is even present on the CultureIndex website ready to vote, attacker may already be able to attack users who try to visit/view the image.
Impact of injecting malicious script to the page may vary, most likely attacker may try to invoke a script that pops up a malicious approve or other well-known wallet drainer logic or use some sort of popups or UI manipulations to social engineer user to execute harmful actions.
Proof of Concept
Function
createPiece
has only one validation routine for the metadatas which is called here validateMediaTypethe function
The validation relies only on checking if string is no empty, which is not a security validation at all. Side note: the text inputs may become an attack vector for such manipulations too, but its rather out of contract scope and something that should be validated in this case on the frontend layer. However, validating an URL may be more tricky, since it still can point to an external resource with a redirection while being correctly formatted.
Tools Used
Manual approach
Recommended Mitigation Steps
The simplest approach could be to force the URL to start with
ipfs://
so user-provided string will be appended toipfs://
which excludes protocol handler tricks such asjavascript:
or redirections. For potential breaking of the URI scheme a validation of only-alphanumeric characters in the URI may come in handy.Assessed type
Invalid Validation