Vulnerability · Published May 8, 2024 · Assigned by GitHub_M
CVE-2024-34347@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE
High 8.4
In plain English
A high-severity command injection in hoppscotch from hoppscotch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code. This is because code inside the vm context can break out if it can get a hold of any reference to an object created outside of the vm. In the case of @hoppscotch/js-sandbox, multiple references to external objects are passed into the vm context to allow pre-request scripts interactions with environment variables and more. But this also allows the pre-request script to escape the sandbox. This vulnerability is fixed in 0.8.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @hoppscotch/cli | 0.8.0 | GHSA-qmmm-73r2-f8xr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hoppscotch | hoppscotch | >= 0.5.0, < 0.8.0 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qmmm-73r2-f8xr x_refsource_CONFIRM
- https://github.com/hoppscotch/hoppscotch/commit/22c6eabd133195d22874250a5ae40cb26b851b01 x_refsource_MISC
- https://www.sonarsource.com/blog/scripting-outside-the-box-api-client-security-risks-part-2 x_refsource_MISC