CVE-2024-28397: js2py RCE Vulnerability

CVE-2024-28397 Overview

CVE-2024-28397 is a code injection vulnerability affecting the js2py Python library, a JavaScript to Python translator and JavaScript interpreter written in pure Python. The vulnerability exists in the js2py.disable_pyimport() function, which is designed to create a sandbox environment by disabling Python imports from within JavaScript code. However, attackers can bypass this security mechanism through a crafted API call, enabling arbitrary code execution within the Python environment.

Critical Impact

Attackers can escape the js2py sandbox environment and execute arbitrary Python code, potentially leading to complete system compromise in applications that rely on js2py for safe JavaScript execution.

Affected Products

• js2py versions up to v0.74
• Applications using js2py for JavaScript sandboxing
• Python environments utilizing js2py with disable_pyimport() protection

Discovery Timeline

• 2024-06-20 - CVE-2024-28397 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-28397

Vulnerability Analysis

This vulnerability represents a sandbox escape flaw (CWE-94: Improper Control of Generation of Code) in the js2py library. The js2py library provides a disable_pyimport() function that is intended to prevent JavaScript code from accessing Python's import system, thereby creating a sandboxed execution environment. However, the implementation of this security control is flawed, allowing attackers to craft specific API calls that bypass the import restrictions.

When exploited, this vulnerability allows malicious JavaScript code executed through js2py to access Python's native functionality, including the ability to import arbitrary modules and execute system commands. This effectively nullifies the security guarantees that applications expect from the sandboxing mechanism.

Root Cause

The root cause of this vulnerability lies in the incomplete implementation of the sandbox isolation in js2py.disable_pyimport(). The function fails to adequately block all pathways through which JavaScript code can access Python's internal mechanisms. Specifically, certain object traversal techniques and prototype manipulation within the JavaScript context can be leveraged to reach Python objects that were intended to be restricted.

Attack Vector

The attack requires local access to an application that uses js2py with the disable_pyimport() sandbox. An attacker must be able to supply JavaScript code to the js2py interpreter, which is then executed in what the application believes is a sandboxed environment. Through careful crafting of JavaScript code that manipulates object prototypes and traverses the internal object hierarchy, the attacker can escape the sandbox and gain access to Python's import system.

Once the sandbox is escaped, the attacker can import arbitrary Python modules such as os or subprocess, enabling command execution on the underlying system with the privileges of the Python process.

The exploitation technique involves manipulating JavaScript objects to access Python's internal structures that remain accessible despite the disable_pyimport() call. Technical details and a proof-of-concept demonstrating this sandbox escape are available in the CVE-2024-28397 PoC repository.

Detection Methods for CVE-2024-28397

Indicators of Compromise

• Unexpected Python module imports occurring within js2py execution contexts
• System command execution originating from Python processes running js2py
• Unusual object traversal patterns in JavaScript code submitted to js2py interpreters
• Evidence of sandbox escape attempts in application logs

Detection Strategies

• Monitor applications using js2py for unexpected system calls or subprocess creation
• Implement logging around js2py execution to capture JavaScript code patterns associated with sandbox escapes
• Use runtime application self-protection (RASP) to detect attempts to access restricted Python objects
• Deploy SentinelOne Singularity to detect anomalous process behavior from Python applications

Monitoring Recommendations

• Enable verbose logging for applications utilizing js2py to capture execution details
• Monitor for process spawning from Python processes that utilize js2py
• Implement network monitoring for unexpected outbound connections from affected applications
• Use file integrity monitoring on systems running vulnerable js2py versions

How to Mitigate CVE-2024-28397

Immediate Actions Required

• Audit all applications to identify usage of js2py library versions up to v0.74
• Evaluate whether the disable_pyimport() function is being relied upon for security boundaries
• Consider removing js2py from production environments where sandboxing is a security requirement
• Implement additional application-level controls to restrict JavaScript input to trusted sources only

Patch Information

As of the last update to this CVE, no official patch has been released that addresses this sandbox escape vulnerability. The js2py library has not received updates to remediate this issue. Organizations should evaluate alternative JavaScript execution solutions that provide stronger isolation guarantees.

For the latest information on patches and security updates, monitor the js2py GitHub repository and the CVE-2024-28397 PoC repository for community developments.

Workarounds

• Replace js2py with alternative JavaScript execution libraries that provide stronger sandboxing, such as PyMiniRacer or containerized execution environments
• Implement process-level isolation using containers or separate processes with restricted permissions when executing untrusted JavaScript
• Apply strict input validation to reject JavaScript code that contains suspicious patterns associated with sandbox escapes
• Run js2py in a minimal privilege environment to limit the impact of successful exploitation

# Example: Running js2py application in a restricted container
# Create a restricted Docker container for js2py execution
docker run --rm \
  --read-only \
  --no-new-privileges \
  --security-opt=no-new-privileges:true \
  --cap-drop=ALL \
  -u nobody:nogroup \
  your-js2py-application