Lack of Input Validation in ExternalDB's get Method

[c4-bot-4]

Lines of code

https://github.com/code-423n4/2024-03-phala-network/blob/a01ffbe992560d8d0f17deadfb9b9a2bed38377e/phala-blockchain/crates/pink/runtime/src/storage/external_backend.rs#L23-L27

Vulnerability details

Impact

The primary impact of this vulnerability is the potential for unauthorized data access and manipulation. Malicious actors can exploit the lack of input validation to access sensitive data or modify existing data in the external storage, leading to data integrity issues, unauthorized disclosure of information, and potentially disrupting the functionality of the system.

Proof of Concept

The get method implementation within the TrieBackendStorage trait for the ExternalDB struct lacks input validation on the key parameter before utilizing it to retrieve data from the external storage. Below is the relevant code snippet:

impl TrieBackendStorage<Hashing> for ExternalDB {
    fn get(&self, key: &Hash, _prefix: Prefix) -> Result<Option<DBValue>, DefaultError> {
        Ok(OCallImpl.storage_get(key.as_ref().to_vec()))
    }
}

The absence of input validation leaves the system susceptible to various security risks. Without proper validation mechanisms, malicious or malformed inputs can exploit the get method, potentially leading to security vulnerabilities and unintended behavior. For instance, an attacker could craft malicious inputs to perform injection attacks, such as SQL injection or NoSQL injection, compromising the integrity and confidentiality of the system's data.

Tools Used

Manual

Recommended Mitigation Steps

Implement robust input validation mechanisms in the get method. Specifically, the system should validate the key parameter to ensure it meets the expected format, length, and content before utilizing it to interact with external resources.

Assessed type

Invalid Validation

[c4-pre-sort]

141345 marked the issue as insufficient quality report

[141345]

here it seems not have injection problem

[c4-judge]

OpenCoreCH marked the issue as unsatisfactory: Insufficient proof