CVE-2017-16088
published 2018-06-07CVE-2017-16088: The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard…
PriorityP352critical10CVSS 3.0
AVNACLPRNUINSCCHIHAH
EPSS
3.49%
87.7th percentile
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hackerone | safe-eval_node_module | — | — |
| safe-eval_project | safe-eval | — | — |
| safe-eval_project | safe-eval | — | — |
| safe-eval_project | safe-eval | — | — |
| safe-eval_project | safe-eval | — | — |
| safe-eval_project | safe-eval | 0 – 0.3.0 | — |
CVSS provenance
nvdv3.010.0CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Sandbox Breakout in safe-eval
ghsa·2018-07-18
CVE-2017-16088 [CRITICAL] CWE-610 Sandbox Breakout in safe-eval
Sandbox Breakout in safe-eval
Affected versions of `safe-eval` are vulnerable to a sandbox escape. By accessing object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
## Proof of Concept:
This code accesses the process object and calls `.exit()`
```js
var safeEval = require('safe-eval');
safeEval("this.constructor.constructor('return process')().exit()");
```
## Recommendation
Update to version 0.4.0 or later
OSV
Sandbox Breakout in safe-eval
osv·2018-07-18
CVE-2017-16088 [CRITICAL] Sandbox Breakout in safe-eval
Sandbox Breakout in safe-eval
Affected versions of `safe-eval` are vulnerable to a sandbox escape. By accessing object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
## Proof of Concept:
This code accesses the process object and calls `.exit()`
```js
var safeEval = require('safe-eval');
safeEval("this.constructor.constructor('return process')().exit()");
```
## Recommendation
Update to version 0.4.0 or later
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-06-07
Published