CVE-2019-10759: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Summary
CVE-2019-10759: Sandbox Breakout / Arbitrary Code Execution in safer-eval. Affects safer-eval versions < 1.3.4. Fixed in 1.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The safer-eval package is an npm package that provides a sandboxed environment for evaluating JavaScript code. It is designed to prevent the execution of malicious code by restricting access to sensitive resources and APIs. However, versions prior to 1.3.4 are vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. This vulnerability allows an attacker to break out of the sandbox and execute arbitrary code.
Vulnerability Detail
The vulnerability in safer-eval arises from a flaw in the sandboxing mechanism. By using constructor properties, an attacker can bypass the sandbox and execute arbitrary code. For example, by evaluating the string console.constructor.constructor('return process')().env, an attacker can access and print the process.env object, potentially exposing sensitive information. This vulnerability has a CVSS score of 9.9, indicating its critical severity.
How To Fix
Minimum fixed version
1.3.4
This is the first release that contains the fix.
npm install safer-eval@1.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the safer-eval package to mitigate the risk of sandbox escape and remote code execution.
Conclusion
The safer-eval package prior to version 1.3.4 is vulnerable to a critical Sandbox Escape vulnerability, allowing for arbitrary code execution. To mitigate this risk, it is crucial to upgrade to version 1.3.4 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for safer-eval →
FAQ
This vulnerability allows an attacker to break out of the sandbox and execute arbitrary code, potentially leading to unauthorized access, data breaches, or system compromise.
To check if your application is affected, you can use the Vulert Playground at Vulert Scanner. It analyzes your package-lock.json file and alerts you in real-time for any open-source vulnerabilities, including this specific vulnerability.
While specific exploits targeting this vulnerability may exist, there are no publicly known exploits at the time of this advisory. However, it is crucial to address the vulnerability promptly by upgrading to the fixed version.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the only way to mitigate the risk effectively.
You can find more information about this vulnerability, including its technical details and the fixed version, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-r3x4-wr4h-pw33/GHSA-r3x4-wr4h-pw33.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for safer-eval.
