Junglewise Threat Intelligence

SES TypedArray hardening bypass with non-canonical numeric properties

Severity: info · Published 2022-10-20

Technologies: ses (npm). Vendors: npm.

Executive brief

SES is a JavaScript library that hardens objects to enable safe sharing between untrusted code segments (co-tenant programs). A defect in the hardening of TypedArray objects allowed properties with non-canonical numeric names (like "+0" instead of "0") to remain writable, enabling co-tenant programs to tamper with each other's APIs or exchange data they shouldn't be able to access.

Technical details

The vulnerability is a logic error in the harden() function's handling of TypedArray properties. The harden function is designed to make non-indexed properties non-writable and non-configurable on TypedArrays, while allowing indexed properties (which hold numeric content) to remain mutable. However, the implementation failed to recognize and lock down properties with non-canonical numeric representations (e.g., "+0", "" which both parse to the number 0), leaving them writable and configurable. An attacker with access to a hardened TypedArray shared between co-tenant programs could use these non-canonical property names as a covert side-channel for API pollution attacks or arbitrary object communication. The vulnerability affects SES versions prior to 0.16.0, which introduced proper validation of non-integer numeric property names. Network reachability is not a factor; exploitation requires the attacker to have a reference to the shared TypedArray and the ability to execute code in a co-tenant context.

Affected products

  • Agoric SES <0.16.0

Timeline

  • 2022-10-19: disclosed
  • 2022-10-20: patched: SES 0.16.0 released with fix

References

Related threats