Sandbox Breakout / Arbitrary Code Execution in localeval

Background

The localeval package is an npm package used for evaluating JavaScript code in a sandboxed environment. It provides a secure way to execute user-provided code without exposing the underlying system. However, all versions of localeval are vulnerable to a Sandbox Escape leading to Remote Code Execution. This vulnerability allows attackers to execute arbitrary code in the system by bypassing the sandbox restrictions.

Vulnerability Detail

The vulnerability in localeval arises from the package's failure to restrict access to the main context through constructor.constructor. This allows attackers to execute arbitrary code in the system. By evaluating the payload constructor.constructor("return process.env")(), an attacker can retrieve the contents of process.env, potentially exposing sensitive information. This vulnerability poses a significant risk as it can lead to remote code execution and compromise the security and integrity of the system.

npm install localeval@15.3.0

Workaround

As there is no fix available, a possible workaround is to avoid using localeval altogether and switch to a different package that provides similar functionality but without the vulnerability. This will help mitigate the risk of sandbox escape and arbitrary code execution. Here is an example of how to use the vm module in Node.js as an alternative:

const vm = require('vm');

const code = 'console.log(process.env);';

const sandbox = {
  console,
  process
};

const script = new vm.Script(code);
const context = new vm.createContext(sandbox);

script.runInContext(context);

This code snippet demonstrates how to execute user-provided code in a sandboxed environment using the vm module in Node.js. By explicitly defining the allowed objects and properties in the sandbox object, you can restrict access to sensitive resources and prevent arbitrary code execution.

Conclusion

The localeval package is vulnerable to a Sandbox Escape leading to Remote Code Execution. This vulnerability allows attackers to execute arbitrary code in the system by bypassing the sandbox restrictions. Currently, there is no fix available, and it is recommended to consider using an alternative package until a fix is made available. Stay updated with the official GitHub repository or the npm package page for any updates on a patched version. For further support on vulnerability remediation, you can reach out to the Devnack team at DevNack.com.

See every vulnerability recorded for localeval →

FAQ