Executive brief
SES is a JavaScript library that hardens objects to enable safe sharing between untrusted code segments (co-tenant programs). A defect in the hardening of TypedArray objects allowed properties with non-canonical numeric names (like "+0" instead of "0") to remain writable, enabling co-tenant programs to tamper with each other's APIs or exchange data they shouldn't be able to access.
Technical details
The vulnerability is a logic error in the harden() function's handling of TypedArray properties. The harden function is designed to make non-indexed properties non-writable and non-configurable on TypedArrays, while allowing indexed properties (which hold numeric content) to remain mutable. However, the implementation failed to recognize and lock down properties with non-canonical numeric representations (e.g., "+0", "" which both parse to the number 0), leaving them writable and configurable. An attacker with access to a hardened TypedArray shared between co-tenant programs could use these non-canonical property names as a covert side-channel for API pollution attacks or arbitrary object communication. The vulnerability affects SES versions prior to 0.16.0, which introduced proper validation of non-integer numeric property names. Network reachability is not a factor; exploitation requires the attacker to have a reference to the shared TypedArray and the ability to execute code in a co-tenant context.
Affected products
- Agoric SES <0.16.0
Timeline
- 2022-10-19: disclosed
- 2022-10-20: patched: SES 0.16.0 released with fix