Sandbox Breakout / Arbitrary Code Execution in notevil

Background

The notevil package is an npm package used for safe evaluation of JavaScript code. It provides a sandbox environment to execute untrusted code securely. The package is designed to prevent access to sensitive JavaScript features and restrict the execution capabilities of the code being evaluated.

Vulnerability Detail

Versions of notevil prior to 1.3.2 are vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. The vulnerability arises from the package's failure to prevent access to the Function constructor. By not properly checking the return values of function calls, attackers can bypass the sandbox and access the Function prototype's constructor. This allows them to execute arbitrary code outside the intended sandbox environment. An example payload demonstrating the vulnerability is as follows:

var safeEval = require('notevil');
var input = "" +
"function fn() {}" +
"var constructorProperty = Object.getOwnPropertyDescriptors(fn.__proto__).constructor;" +
"var properties = Object.values(constructorProperty);" +
"properties.pop();" +
"properties.pop();" +
"properties.pop();" +
"var Function = properties.pop();" +
"(Function('return this'))();";
safeEval(input);

This vulnerability can have severe consequences as it allows an attacker to execute arbitrary code with the privileges of the application using the notevil package.

npm install notevil@1.3.2

Workaround

There is no known workaround for this vulnerability. Upgrading to the fixed version is the only recommended solution.

Conclusion

The notevil package prior to version 1.3.2 is vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. It is crucial to upgrade to the fixed version to ensure the secure execution of untrusted code. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for notevil →

FAQ