Node.js sandboxes are open to prototype pollution

guest · Oct 25, 2021

Node.js sandboxes are open to prototype pollution
Sandbox breakout can lead to remote code execution, researchers warn
October 22, 2021
https://portswigger.net/daily-swig/node-js-sandboxes-are-open-to-prototype-pollution

A bug in vm2, a sandbox for testing untrusted JavaScript code, makes it possible for malicious parties to circumvent the library’s security controls and carry out remote code execution (RCE) attacks, a group of researchers have found.

vm2’s GitHub page describes the library as “a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!”
However, CISPA Helmholtz Center for Information Security, a cybersecurity research group in Germany, found that the library is open to prototype pollution attacks.
Click to expand...

Sandbox breakout
A proof-of-concept (PoC) on Snyk shows how a few lines of code can exploit the vulnerability in vm2 to carry out a prototype pollution and RCE attack on the host.

While the bug has been filed as ‘prototype pollution’, Cristian-Alexandru Staicu, one of the researchers who helped discover and report the bug, told The Daily Swig that a better title would be “sandbox breakout”.
The team found the bug during a months-long project investigating vulnerabilities in JavaScript sandboxes.
Click to expand...

Log in or Sign up

Node.js sandboxes are open to prototype pollution

guest Guest

Log in or Sign up

Node.js sandboxes are open to prototype pollution

guest Guest

Useful Searches