Quick answers
- Is CVE-2017-16088 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2017-16088 being exploited in the wild.
- How severe is CVE-2017-16088?
- Low severity, with a CVSS score of 3, published 18 July 2018.
- Which products and versions are affected?
- safe-eval (npm) 0.3.0 and earlier.
- Is there a fix for CVE-2017-16088?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2017-16088 attacked?
- It is attacked over the network.
- Am I affected by CVE-2017-16088?
- Check whether you run safe-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a sandbox escape vulnerability in the safe-eval library caused by inadequate isolation of JavaScript object constructors. An unauthenticated attacker can pass malicious code like `this.constructor.constructor('return process')().exit()` which exploits the constructor chain to access Node.js's `process` object and invoke arbitrary functions. The vulnerability affects all versions prior to 0.4.0; no authentication or user interaction is required—only network access to an application using safe-eval. An attacker can achieve remote code execution, process termination, and access to the entire Node.js standard library. The fix is to update to version 0.4.0 or later.
Affected products
- npm safe-eval 0.3.0 and earlier
Identifiers
- CVE-2017-16088
- GHSA-ww6v-677g-p656
Timeline
- 2017-03-04: disclosed: Issue reported on GitHub
- 2018-07-18: advisory: GHSA advisory published