safe-eval critical vulnerability is fixed?

[jasonkhanlar]

https://www.npmjs.com/package/safe-eval

safe-eval 0.3.0 and below are affected by a sandbox breakout vulnerability - NSP 337, CVE-2017-16088.

Version 0.4.0 fixes this vulnerability. It is highly recommended to upgrade to the latest version if you are using safe-eval for executing code not generated by yourself. Thanks @kauegimenes for the patch.

However, after installing safe-eval 0.4.1 I see this in npm audit:

+ [email protected]
added 1 package from 1 contributor and audited 513 packages in 1.604s
found 2 vulnerabilities (1 low, 1 critical)
  run `npm audit fix` to fix them, or `npm audit` for details
[ryzen@ryzen cafe_loco_bot]$ npm audit
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Sandbox Breakout                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ safe-eval                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ safe-eval [dev]                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ safe-eval                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/337                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

https://nodesecurity.io/advisories/337

[kaue]

We problably need to notify npm about that

[CesarLanderos]

@kauegimenes is there any progress on notifying npm? we are still getting the vulnerability warning, can anyone let them know?

[CesarLanderos]

@hacksparrow ?

[hacksparrow]

@CesarLanderos there are still ways to circumvent the safety measures in safe-eval. Unfortunately, I don't have the time to come up with a solution, at the moment.

The package is very much safe to be used for evaluation code generated by yourself. It can be dangerous where the input is user-submitted/manipulated by a user.

[xinaesthete]

Hmm, seems to limit its usefulness...

[kaue]

#13

[evilpacket]

We have updated the advisory to state that 0.4.0 and later are safe related to this advisory.

[kaue]

Thanks @evilpacket =)

[ChrisCinelli]

It is not fixed anymore. Why was the #13 revered and 0.4.2 never published? @hacksparrow please.

[ChrisCinelli]

It has never been fixed and will likely never been. See #16.

[xinaesthete]

I think @hacksparrow just needs to be very much clearer on what use-cases this is able to make safer, and flag very clearly in the description that user-submitted code is not one of them.

The package is very much safe to be used for evaluation code generated by yourself. It can be dangerous where the input is user-submitted/manipulated by a user.

[FINDarkside]

I think @hacksparrow just needs to be very much clearer on what use-cases this is able to make safer, and flag very clearly in the description that user-submitted code is not one of them.

To me, it seems like there is no use case at the moment. If I can assume that the input isn't malicious, I could just feed it to eval.

[xinaesthete]

I guess if you're making something like a live-coding or visual programming app or something like that, then you could be generating code from user input with certain constraints such that you believe it is impossible to generate something unsafe and use this as a bit of an extra measure or something... but I'm clutching at straws.

[mgttt]

have you tried this damn case:

(
delete(this.constructor.constructor),delete(this.constructor),
this.constructor.constructor("return process")()
)