Sandbox Breakout / Arbitrary Code Execution in @zhaoyao91/eval-in-vm
Summary
GHSA-jp99-5h8w-gmxc: Sandbox Breakout / Arbitrary Code Execution in @zhaoyao91/eval-in-vm. Affects @zhaoyao91/eval-in-vm versions >= 0.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @zhaoyao91/eval-in-vm package is an npm package that provides a sandboxed environment for evaluating JavaScript code. It allows users to execute code within a virtual machine, providing a layer of security by isolating the code from the main context. However, all versions of this package are vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. The vulnerability arises from a failure to restrict access to the main context through this.constructor.constructor. This allows attackers to execute arbitrary code in the system, potentially leading to unauthorized access or control over the host environment.
Vulnerability Detail
The Sandbox Escape vulnerability in @zhaoyao91/eval-in-vm allows an attacker to break out of the sandboxed environment and execute arbitrary code in the system. By leveraging the this.constructor.constructor property, an attacker can access the main context and execute malicious code. For example, evaluating the payload this.constructor.constructor('return process.env')() would print the contents of the process.env object, potentially exposing sensitive information. This vulnerability poses a significant risk as it enables remote code execution, which can lead to unauthorized access, data breaches, or system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, a workaround for this vulnerability is to manually review and validate any code executed within the sandboxed environment. Ensure that untrusted code is not executed and restrict access to sensitive resources. Additionally, consider implementing additional security measures such as code reviews, input validation, and access controls to mitigate the risk of code execution vulnerabilities.
Conclusion
The @zhaoyao91/eval-in-vm package is vulnerable to a Sandbox Escape vulnerability, which allows attackers to execute arbitrary code in the system. Currently, there is no fix available for this vulnerability, and it is recommended to avoid using the package until a fix is provided. Mitigation strategies include switching to alternative packages and implementing additional security measures. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @zhaoyao91/eval-in-vm →
FAQ
The vulnerability allows an attacker to break out of the sandboxed environment and execute arbitrary code in the system. This can lead to unauthorized access, data breaches, or complete compromise of the host environment.
Currently, there is no fix available for this vulnerability. It is recommended to avoid using the @zhaoyao91/eval-in-vm package until a fix is made available.
Yes, all versions of the @zhaoyao91/eval-in-vm package are vulnerable to this Sandbox Escape vulnerability.
To mitigate the risk, it is recommended to avoid using the @zhaoyao91/eval-in-vm package and switch to an alternative package that does not suffer from this vulnerability. Additionally, implement security measures such as code reviews, input validation, and access controls to reduce the risk of code execution vulnerabilities.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-jp99-5h8w-gmxc/GHSA-jp99-5h8w-gmxc.json
