Is CVE-2017-16226 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-16226 being exploited in the wild.

How severe is CVE-2017-16226?

Informational severity, with a CVSS score of 7.5, published 6 August 2018.

Is there a fix for CVE-2017-16226?

A patch was published on 2017-10-05: Security patch merged in PR #18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-16226 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-16226?

Check whether you run static-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-16226: static-eval sandbox breakout / arbitrary code execution

CVE-2017-16226 · Severity: info · CVSS 7.5 · Published 2018-08-06

static-eval is a Node.js library designed to safely evaluate simple code expressions in a sandboxed environment with no access to the underlying system. However, versions before 2.0.0 fail to properly validate user input, allowing attackers to escape the sandbox and execute arbitrary code on the server. This could be exploited through dependent packages (like jsonpath and Ghost) that rely on static-eval for user-supplied query expressions, potentially compromising entire applications.

Technologies: static-eval (npm). Vendors: npm.

Quick answers

Is CVE-2017-16226 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-16226 being exploited in the wild.
How severe is CVE-2017-16226?: Informational severity, with a CVSS score of 7.5, published 6 August 2018.
Which products and versions are affected?: static-eval (npm) <2.0.0.
Is there a fix for CVE-2017-16226?: A patch was published on 2017-10-05: Security patch merged in PR #18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-16226 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-16226?: Check whether you run static-eval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from improper input validation (CWE-20) where static-eval passes untrusted AST expressions directly to the Function constructor without restricting access to dangerous functionality. The vulnerability has two exploitation vectors: (1) FunctionExpression bodies are not validated, allowing arbitrary code in function declarations, and (2) member attribute access is not restricted, allowing attackers to access the Function constructor via `(function(){}).constructor` to create and execute arbitrary functions. The attack requires the attacker to control AST input fed to the evaluate() function, which may occur through dependent libraries that parse user-supplied expressions (e.g., jsonpath query filters). The vulnerability was patched in version 2.0.0 by walking function bodies during evaluation and blocking member expression access to function objects.

Affected products

npm static-eval <2.0.0

Identifiers

CVE-2017-16226
GHSA-5mjw-6jrh-hvfq

Timeline

2017-10-16: disclosed: Vulnerability publicly disclosed by Matt Austin
2017-10-05: patched: Security patch merged in PR #18
2018-08-06: advisory: GitHub Advisory GHSA-5mjw-6jrh-hvfq published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.