Executive brief
realms-shim is a JavaScript library that implements a security sandbox for executing untrusted code in isolation. A prototype pollution vulnerability allows attackers to escape the sandbox and modify the behavior of the entire JavaScript runtime, potentially leading to unauthorized code execution and data access.
Technical details
The vulnerability is a prototype pollution attack (CWE-1321) affecting all versions of realms-shim up to and including version 1.2.2. Prototype pollution allows an attacker to modify the prototype chain of JavaScript objects, which in the context of a sandboxed environment can break the sandbox isolation. The attack is network-reachable and requires no authentication or user interaction; it can be triggered by providing malicious input to the realms-shim library. A successful exploit enables an attacker to bypass the sandbox restrictions and gain full control over the JavaScript execution context, potentially accessing sensitive data or executing arbitrary code with the privileges of the host application.
Affected products
- Agoric realms-shim 0 through 1.2.2
Timeline
- 2022-01-10: disclosed: Published on NVD
- 2022-01-13: advisory: GHSA advisory published