GHSA-7r5f-7qr4-pf6q Sandbox Breakout / Arbitrary Code Execution in notevil
Attackers can escape the sandbox and execute arbitrary code by accessing the Function constructor, requiring an upgrade to the notevil library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7r5f-7qr4-pf6q?
GHSA-7r5f-7qr4-pf6q is a code injection vulnerability in notevil, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of notevil prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the Function constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor leading to the Sandbox Escape. An example payload is:
var safeEval = require('notevil')
var input = "" +
"function fn() {};" +
"var constructorProperty = Object.getOwnPropertyDescriptors(fn.__proto__).constructor;" +
"var properties = Object.values(constructorProperty);" +
"properties.pop();" +
"properties.pop();" +
"properties.pop();" +
"var Function = properties.pop();" +
"(Function('return this'))()";
safeEval(input)```
## Recommendation
Upgrade to version 1.3.2 or later.
Which versions are affected by GHSA-7r5f-7qr4-pf6q?
2 open source packages ship an affected version, including notevil.
| Package | Affected | Fixed in |
|---|---|---|
notevil npm | All versions | 1.3.2 |
notevil npm | All versions | 1.3.2 |
How do I fix GHSA-7r5f-7qr4-pf6q?
Upgrade notevil to 1.3.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-7r5f-7qr4-pf6q being exploited?
There is no known exploitation of GHSA-7r5f-7qr4-pf6q in the wild and no public exploit code.