Executive brief
static-eval is a Node.js library designed to safely evaluate simple code expressions in a sandboxed environment with no access to the underlying system. However, versions before 2.0.0 fail to properly validate user input, allowing attackers to escape the sandbox and execute arbitrary code on the server. This could be exploited through dependent packages (like jsonpath and Ghost) that rely on static-eval for user-supplied query expressions, potentially compromising entire applications.
Technical details
The vulnerability stems from improper input validation (CWE-20) where static-eval passes untrusted AST expressions directly to the Function constructor without restricting access to dangerous functionality. The vulnerability has two exploitation vectors: (1) FunctionExpression bodies are not validated, allowing arbitrary code in function declarations, and (2) member attribute access is not restricted, allowing attackers to access the Function constructor via `(function(){}).constructor` to create and execute arbitrary functions. The attack requires the attacker to control AST input fed to the evaluate() function, which may occur through dependent libraries that parse user-supplied expressions (e.g., jsonpath query filters). The vulnerability was patched in version 2.0.0 by walking function bodies during evaluation and blocking member expression access to function objects.
Affected products
- npm static-eval <2.0.0
Timeline
- 2017-10-16: disclosed: Vulnerability publicly disclosed by Matt Austin
- 2017-10-05: patched: Security patch merged in PR #18
- 2018-08-06: advisory: GitHub Advisory GHSA-5mjw-6jrh-hvfq published