Node.js Sandbox Escape: BaseHandler.set Ignores Receiver Parameter

Vulnerability Overview This vulnerability involves the method in Node.js, which presents a security issue when handling the receiver. Specifically, ignores the parameter defined in ECMAScript 2022 section 9.5.9. This oversight allows sandboxed code to bypass security restrictions by constructing specific objects, thereby enabling unauthorized operations on host objects. Scope of Impact Affected Versions: Node.js 16.14.0 and earlier. Affected Scenarios: Any scenario utilizing the method, particularly those involving interactions between sandboxed environments and host objects. Potential Risks: Attackers can exploit this vulnerability to execute arbitrary code on host objects, potentially leading to severe consequences such as data leakage and privilege escalation. Remediation Steps 1. Code Fix: - Modify the method to ensure it correctly handles the receiver parameter. - In , patch so it can properly identify and process the receiver parameter. 2. Patch Release: - Release patched versions to address the aforementioned issues. - Update relevant documentation to describe the fix details and impact scope. 3. Testing and Verification: - Develop test cases to verify that the fixed code effectively prevents exploitation of the vulnerability. - Conduct regression testing to ensure the fix does not introduce new issues. POC Code The following POC code can be used to verify the vulnerability: `` const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox = { hostFn: hostFn, }; vm.runInNewContext( const util = require('util'); const vm = require('vm'); const hostFn = function api(cb) { cb(null, 'real-data'); }; const sandbox =

Goal Reached Thanks to every supporter — we hit 100%!

Node.js Sandbox Escape: BaseHandler.set Ignores Receiver Parameter

More from this source