Mitigation Strategies

To mitigate this vulnerability, you should upgrade SandboxJS to version 0.8.31 or later, where the sandbox escape vulnerability has been fixed.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in SandboxJS, a JavaScript sandboxing library, in versions prior to 0.8.31. It allows sandboxed code to escape the sandbox by mutating host built-in prototypes. This happens because the isGlobal protection flag, which normally prevents such mutations, can be bypassed by laundering it through array literal intermediaries. When a global prototype reference like Map.prototype or Set.prototype is placed into an array and then retrieved, the isGlobal taint is removed, enabling direct mutation of the prototype from within the sandbox.

This leads to persistent prototype pollution on the host side and may allow remote code execution (RCE) in applications that use the polluted properties in sensitive operations, such as executing commands via execSync(obj.cmd). The issue was fixed in version 0.8.31.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including allowing an attacker to escape the sandbox environment and mutate host prototypes persistently. This prototype pollution can lead to remote code execution (RCE) if the polluted properties are used in sensitive operations within the application.

Such an exploit could compromise the integrity, confidentiality, and availability of the affected system, potentially allowing attackers to execute arbitrary commands, manipulate application behavior, or gain unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0