Executive brief
realms-shim is a JavaScript library that provides sandboxed code execution, restricting untrusted code to a limited set of exposed objects and functions. A flaw in the code transformation pipeline exposed internal Realm objects to transformer functions, allowing confined code to escape the sandbox and gain full control of the parent application.
Technical details
The vulnerability is a sandbox escape caused by improper isolation of internal Realm objects during the transformation pipeline. The evaluate() function accepts a transforms option containing code rewriting functions (intended for Babel-like syntax extensions). A primal-Realm object was inadvertently exposed to these transform functions; malicious confined code could provide a crafted rewriter that captured this object and used it to break out of the sandbox. The attack requires the confined code to have access to the evaluate() function with transforms enabled. The vulnerability is fixed in version 1.2.1.
Affected products
- Agoric realms-shim <1.2.1
Timeline
- 2019-10-16: disclosed
- 2019-10-16: patched: Fix released in version 1.2.1