CVE-2021-23594
📋 TL;DR
The realms-shim package is vulnerable to sandbox bypass via prototype pollution, allowing attackers to modify JavaScript object prototypes and potentially execute arbitrary code. This affects all applications using any version of realms-shim, particularly Node.js applications that implement sandboxing for untrusted code execution.
💻 Affected Systems
- realms-shim
📦 What is this software?
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete sandbox escape leading to remote code execution, privilege escalation, and full system compromise.
Likely Case
Arbitrary code execution within the application context, data manipulation, and potential lateral movement.
If Mitigated
Limited impact if proper input validation and sandboxing controls are implemented alongside the package.
🎯 Exploit Status
Prototype pollution vulnerabilities are well-understood and easily weaponized in JavaScript environments.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://www.npmjs.com/package/realms-shim
Restart Required: Yes
Instructions:
No official patch exists. Remove realms-shim entirely and replace with alternative sandboxing solutions.
🔧 Temporary Workarounds
Remove realms-shim package
allUninstall realms-shim and replace with secure alternatives like isolated-vm or vm2 with proper configuration.
npm uninstall realms-shim
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all data passed to realms-shim sandboxes
- Run applications with minimal privileges and in isolated containers to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for realms-shim: grep -r 'realms-shim' package.json node_modules/Check Version:
npm list realms-shimVerify Fix Applied:
Verify realms-shim is no longer in package.json or node_modules directory📡 Detection & Monitoring
Log Indicators:
- Unusual process spawning from Node.js applications
- Unexpected file system modifications by Node processes
Network Indicators:
- Outbound connections from Node.js processes to unexpected destinations
SIEM Query:
process.name:node.exe AND (process.cmdline:*realms-shim* OR process.cmdline:*sandbox*)