Executive brief
safe-eval is a Node.js library designed to safely evaluate JavaScript code in a sandboxed environment. The library fails to properly restrict access to the main JavaScript context through Error objects, allowing an attacker to break out of the sandbox and execute arbitrary system commands. An unauthenticated attacker can craft malicious code that, when evaluated by safe-eval, gains full access to the system and can read sensitive data or execute any command.
Technical details
safe-eval contains a sandbox escape vulnerability (CWE-94: Improper Control of Generation of Code) caused by insufficient restriction on prototype manipulation and constructor access through Error objects. An attacker can set a custom __proto__ on an Error object and manipulate the stack property to return a function via a match method that accesses the constructor chain, gaining access to the global context and eval-like functionality. The attack requires no authentication or user interaction—the vulnerable code path is reached whenever untrusted code is passed to safe-eval's evaluation function. An attacker can execute arbitrary system commands, read process environment variables, or achieve full remote code execution. No patch is available; the recommendation is to use an alternative sandboxing solution.
Affected products
- safe-eval safe-eval all versions up to and including 0.4.1
Timeline
- 2020-08-25: disclosed
- 2020-08-21: other: NVD published