High, CVSS 8.3npmAmendedPublished
@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE
CVE-2024-34347 · GHSA-qmmm-73r2-f8xr
- Affected
- npm @hoppscotch/cli >= 0.5.0, < 0.8.0
- Fixed in
- 0.8.0· Vendor fix available
- Issue
- Observations The Hoppscotch desktop app takes multiple precautions to be secure against arbitrary JavaScript and system command execution. It does not render user-controlled HTML or Markdown, uses Tauri instead of Electron, and sandboxes pre-request scripts with a simple yet secure implementation using web workers. Unfortunately, web workers are not available in a pure Node.js application like Hoppscotch CLI. That is why the @hoppscotch/js-sandbox package also provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code, as stated in the documentation. This is because code inside the vm context can break out if it can get a hold of any reference to an object created outside of the vm. In the case of @hoppscotch/js-sandbox, multiple references to external objects are passed into the vm context to allow pre-request scripts interactions with environment variables and more. But this also allows the pre-request…
Recommended action: Upgrade to 0.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.