CVE-2017-16088: Sandbox Breakout in safe-eval

Background

The safe-eval package is an npm package that provides a sandboxed JavaScript evaluator. It allows users to execute JavaScript code in a controlled environment, preventing access to potentially harmful operations. However, certain versions of safe-eval are vulnerable to a sandbox escape, which can lead to unauthorized access to the entire standard library and potential security breaches.

Vulnerability Detail

The vulnerability in safe-eval arises from the ability of un-sanitized user input to access object constructors. By exploiting this, an attacker can break out of the sandbox and gain access to sensitive resources. For example, an attacker could access the process object and call .exit(), potentially terminating the application or executing arbitrary code. This vulnerability poses a significant risk as it allows an attacker to bypass the intended restrictions of the sandbox and perform unauthorized actions.

Workaround

If updating to the latest version of safe-eval is not immediately feasible, a temporary workaround is to avoid using un-sanitized user input in the evaluation process. By thoroughly validating and sanitizing user input before passing it to safe-eval, the risk of a sandbox escape can be mitigated. Here is an example of how to sanitize user input in Node.js:

const safeEval = require('safe-eval');

function sanitizeInput(input) {
  // Perform input validation and sanitization
  // ...
  return sanitizedInput;
}

const userInput = 'this.constructor.constructor(\'return process\')().exit()';
const sanitizedInput = sanitizeInput(userInput);

safeEval(sanitizedInput);

Conclusion

The safe-eval package is vulnerable to a sandbox escape, allowing unauthorized access to the standard library. It is crucial to update to version 0.4.0 or later to fix this vulnerability. If immediate updating is not possible, sanitizing user input can provide a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for safe-eval →

FAQ