Forest Global Training Partners

Cyber Risks · PortSwigger Research

Attacking and defending Java Script sandboxes

Summary: PortSwigger researcher Gareth Heyes examined several existing JavaScript sandboxes built on proxies and the 'with' statement and found each could be escaped: missing syntax checks allowed a closing curly brace to break out of the 'with' block, unfrozen prototypes let attackers overwrite functions like indexOf to pass allow lists, and the Function constructor and generator constructors remained reachable. He then built a proxy-based sandbox with a checkSyntax function, frozen global prototypes, an allow list, and the 'use strict' directive, but noted that dynamic import cannot be overwritten or intercepted and had to be filtered with a regex, while generator methods were disabled outright.

What you should know: Heyes states plainly that he expects his own sandbox to be broken, and it was: Michał Bentkowski bypassed it with async functions and async generators, which carry their own Function constructors, then again through a dynamic import comment form the regex missed, and Antony Garand found BigInt left unfrozen. Any team relying on in-language JavaScript sandboxing to contain untrusted code should treat each of those bypasses as a known gap rather than a hypothetical.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related