Executive brief
safe-eval is a JavaScript library designed to safely evaluate code expressions in a sandboxed environment. Due to improper input sanitization, attackers can exploit prototype pollution to escape the sandbox and achieve remote code execution on systems using the library, potentially compromising the entire application and underlying infrastructure.
Technical details
safe-eval contains a prototype pollution vulnerability resulting from inadequate input validation and sanitization of user-supplied code. The vulnerability can be exploited through functions such as defineGetter, stack(), toLocaleString(), propertyIsEnumerable.call(), and valueOf() to pollute the prototype chain. An attacker can craft a malicious code string (no authentication required; the vulnerable function is typically called with untrusted input) that escapes the sandbox isolation and executes arbitrary system commands via Node.js runtime functionality. The vulnerability affects all versions up to and including 0.4.2, and successful exploitation results in remote code execution with the privileges of the application process.
Affected products
- safe-eval safe-eval up to and including 0.4.2
Timeline
- 2023-04-11: disclosed: Vulnerability published via GitHub Security Advisory
- 2022-12-21: exploited: Proof of concept demonstrated in GitHub issue #27