sherlock-audit / 2023-03-sense-judging

4 stars 0 forks source link

darshan - Dependency Confusion Attack Deu to Unclamed Package #31

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

darshan

medium

Dependency Confusion Attack Deu to Unclamed Package

Summary: The package named "@sense-finance/sense-v1" found on https://github.com/sense-finance/sense-v1/blob/82abac25404d83b7aefaaeb46631f1d050dc4a4e/package.json is unclaimed on the NPM package registry. This makes the package vulnerable to a Dependency Confusion Attack, where an attacker can claim the package and upload malicious code under that unclaimed package. As a result, users who depend on this package can download the malicious code, leading to remote code execution on their machines.

Vulnerability Description: The "@sense-finance/sense-v1" package found on https://github.com/sense-finance/sense-v1/blob/82abac25404d83b7aefaaeb46631f1d050dc4a4e/package.json has not been claimed on the NPM registry. This means that an attacker can claim this package and upload malicious code under that package name. When developers or users depend on this package in their code, they may unknowingly download the malicious code, leading to remote code execution on their machines.

Impact: This vulnerability allows an attacker to execute arbitrary code on a user's machine, leading to a complete takeover of the user's system, stealing sensitive information, or deploying ransomware on the system.

Steps to Reproduce:

  1. Go to https://www.npmjs.com/ and search for the "@sense-finance/sense-v1" package.
  2. Observe that the package is unclaimed.
  3. Claim the package under your account.
  4. Upload a malicious code to the package.
  5. Wait for developers or users to depend on this package in their code. Observe the remote code execution on the users' machines.

Recommended Mitigation: Sense should claim the package "@sense-finance/sense-v1" on the NPM registry to prevent any unauthorized access. They should also perform a security audit of their code to ensure that it is not vulnerable to any other dependency confusion attacks.

Developers and users who depend on the "@sense-finance/sense-v1" package should be advised to verify the authenticity of the package before adding it as a dependency. They should also avoid using unclaimed packages in their code.