Executive brief
constantinople is a JavaScript library that evaluates whether expressions are constant values. Versions prior to 3.1.1 contain a sandbox bypass vulnerability allowing attackers to execute arbitrary code on systems using the library. An attacker with network access can exploit this without authentication to compromise the affected system.
Technical details
constantinople is a JavaScript library used to determine whether expressions evaluate to constants by parsing and analyzing abstract syntax trees (AST). Versions prior to 3.1.1 fail to properly sandbox expression evaluation, allowing attackers to break out of the sandbox and execute arbitrary JavaScript code. The vulnerability is remotely exploitable (network-accessible attack vector) with no authentication or special privileges required. An attacker can send crafted input to trigger unsafe evaluation, resulting in complete compromise of confidentiality and integrity of the affected system. The fix was implemented in version 3.1.1 by rewriting the library in TypeScript to properly evaluate the AST instead of using unsafe eval operations.
Affected products
- pugjs constantinople <3.1.1
Timeline
- 2018-04-21: disclosed
- 2019-06-14: advisory: GitHub Security Advisory published
- 2019-06-10: patched: Version 3.1.1 released with fix