Executive brief
metacalc is a spreadsheet calculation library used for formula evaluation in Node.js applications. Versions before 0.0.2 allow attackers to execute arbitrary code by leveraging exposed Math functions to bypass the sandbox and access the Function constructor. This can lead to complete compromise of the application and underlying system, including theft of sensitive data and malware installation.
Technical details
The vulnerability is a code injection flaw (CWE-94) in how metacalc exposes JavaScript's Math class to the v8 sandbox context used for formula evaluation. An attacker can craft a spreadsheet formula like `=Math.ceil.constructor("malicious_code")()` to access the Function constructor and execute arbitrary JavaScript code outside the sandbox. No authentication or user interaction is required; the attack occurs when a formula is evaluated in a cell. Successful exploitation allows arbitrary code execution with full Node.js runtime access, including process spawning and filesystem access. The fix was released in version 0.0.2.
Affected products
- metarhia metacalc <0.0.2
Timeline
- 2022-05-17: disclosed
- 2022-06-08: patched