Security researchers at Endor Labs have disclosed a vulnerability in the popular isolated-vm Node.js library that can allow sandboxed JavaScript to break out of its restricted environment and interfere with the host process.
The flaw, tracked as GHSA-864f-rcv7-6rh4, affects isolated-vm versions 7.0.0 and earlier. It has not yet received a CVE identifier and has been fixed in versions 6.2.0 and 7.0.1.
Isolated-vm provides developers with access to Google’s V8 Isolate technology, allowing applications to run untrusted JavaScript in separate environments. The npm package receives roughly one million weekly downloads, making the issue relevant to a broad range of applications that depend on sandboxed code execution.
How the Sandbox Escape Works
Researchers traced the vulnerability to ExternalCopy, a component isolated-vm uses to transfer data between isolated JavaScript environments. The flaw involves a type confusion issue in the way ‘ExternalCopy’ handles its ‘transferList’ option. Under the right conditions, malicious code inside the sandbox can corrupt memory belonging to the host process rather than remaining confined to its own environment.
They demonstrated how the issue could reliably crash the host process and could be extended far enough to hijack its control flow, creating the potential for remote code execution on the host system.
Importantly, the underlying V8 isolation mechanism itself wasn’t broken. The weakness exists in the C++ code responsible for transferring information across the isolation boundary, showing how surrounding integration code can undermine an otherwise secure sandbox.
The isolated-vm project already warns developers that exposing certain library objects to untrusted code can provide a path back into the main Node.js process, and recommends keeping isolated workloads separated from critical infrastructure where possible.
Developers Should Update
Applications using isolated-vm should upgrade to version 7.0.1 or 6.2.0, depending on the release branch in use.
Full exploit details have been withheld to reduce the risk of abuse, but the demonstrated ability to escape the sandbox makes the issue especially important for services that use isolated-vm to execute customer-supplied or otherwise untrusted JavaScript.
The vulnerability is another reminder that sandbox security depends on more than the isolation technology itself. Code responsible for moving data and capabilities across that boundary must be treated as part of the same security perimeter.
Leave a Reply