Sandbox Breakout / Arbitrary Code Execution in pitboss-ng
Summary
GHSA-3gpc-w23c-w59w: Sandbox Breakout / Arbitrary Code Execution in pitboss-ng. Affects pitboss-ng versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pitboss-ng is an npm package that is used for sandboxing JavaScript code execution. It provides a secure environment for running untrusted code by restricting access to certain resources. However, all versions of pitboss-ng are vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. This vulnerability allows attackers to bypass the sandbox and execute arbitrary code in the system. The package fails to restrict access to the main context through this.constructor.constructor, which can be exploited by attackers.
Vulnerability Detail
The Sandbox Escape vulnerability in pitboss-ng arises from the package's inability to properly restrict access to the main context. By leveraging this.constructor.constructor, an attacker can execute arbitrary code in the system. For example, evaluating the payload this.constructor.constructor('return process.env')() allows an attacker to print the contents of process.env. This vulnerability poses a significant risk as it enables unauthorized code execution and potential system compromise.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
npm install pitboss-ng@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there is no fix available, a possible workaround is to manually review and modify the code of pitboss-ng to address the vulnerability. This may involve implementing proper access restrictions to the main context and ensuring that the sandbox environment is secure. However, this workaround requires a deep understanding of the package's code and may not be feasible for all users.
Conclusion
The Sandbox Breakout vulnerability in pitboss-ng exposes a critical security flaw that allows attackers to escape the sandbox and execute arbitrary code in the system. As there is currently no fix available, it is recommended to use an alternative package until a patch is released. Developers should stay updated with the official repository for any updates or patches addressing this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pitboss-ng →
FAQ
pitboss-ng is an npm package used for sandboxing JavaScript code execution. It provides a secure environment for running untrusted code.
The vulnerability allows attackers to escape the sandbox and execute arbitrary code in the system, potentially leading to unauthorized access, data breaches, or system compromise.
No, currently there is no fix available for this vulnerability in pitboss-ng. It is recommended to use an alternative package until a fix is released.
While there is no official fix, developers can manually review and modify the code of pitboss-ng to address the vulnerability. However, this requires a deep understanding of the package's code and may not be feasible for all users.
For more information about this vulnerability, you can refer to the official GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-3gpc-w23c-w59w/GHSA-3gpc-w23c-w59w.json
