Executive brief
Hoppscotch CLI is a command-line tool for testing APIs, and includes a feature to run pre-request scripts before sending HTTP requests. An attacker can craft a malicious Hoppscotch collection file and trick a user into running it with the CLI, causing arbitrary system commands to execute on the victim's machine with the privileges of the user running the CLI.
Technical details
The vulnerability is a sandbox escape in the @hoppscotch/js-sandbox package, which uses Node.js's vm module to sandbox pre-request scripts. The vm module is documented as unsafe for untrusted code because context objects can leak references to the outer scope. Specifically, the vulnerable code exposes the `pw` object (along with atob/btoa) to the vm context. An attacker can traverse the prototype chain via `pw.constructor.constructor('return this')()` to access the global scope, then use `require('child_process')` to execute arbitrary commands via `execSync()`. Attack vector is network (attacker distributes a malicious collection file), requires user interaction (victim must download and run it with the CLI), and affects versions 0.5.0 through 0.7.x. The fix is available in version 0.8.0 and later.
Affected products
- Hoppscotch CLI 0.5.0 to 0.7.x
Timeline
- 2024-04-22: disclosed: Security advisory published
- 2024-04-22: patched: Fix released in version 0.8.0