Executive brief
pitboss-ng is a library used to run untrusted code in a restricted 'sandbox' environment. A security flaw allows that untrusted code to break out of its restrictions and run commands directly on the underlying server. This could lead to a total system takeover, data theft, or service disruption.
Technical details
The pitboss-ng package fails to properly isolate the execution context, allowing untrusted code to access the global Function constructor via 'this.constructor.constructor'. By leveraging this access, an attacker can escape the sandbox and execute arbitrary JavaScript in the main process context. For example, an attacker could access sensitive environment variables or the filesystem using Node.js built-in modules like 'process'. This vulnerability is exploitable by any user capable of providing code to be evaluated by the library. The issue is resolved in version 2.0.0.
Affected products
- pitboss-ng pitboss-ng < 2.0.0
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-04: disclosed: Advisory published
- 2020-09-04: patched: Version 2.0.0 released to address the issue