CVE-2023-26121
📋 TL;DR
CVE-2023-26121 is a prototype pollution vulnerability in the safe-eval npm package that allows attackers to modify JavaScript object prototypes, potentially leading to remote code execution or denial of service. Any application using safe-eval for evaluating untrusted code is affected. The vulnerability exists because the safeEval function doesn't properly sanitize input parameters.
💻 Affected Systems
- safe-eval npm package
📦 What is this software?
Safe Eval by Safe Eval Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or lateral movement within the network.
Likely Case
Denial of service, application crashes, or limited data manipulation through prototype pollution.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing application instability.
🎯 Exploit Status
Proof-of-concept code is publicly available. Exploitation requires the application to process untrusted input through safeEval.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://github.com/hacksparrow/safe-eval/issues/28
Restart Required: No
Instructions:
1. Remove safe-eval from your project dependencies. 2. Use alternative sandboxing solutions like vm2, isolated-vm, or Node.js worker threads. 3. Update package.json to remove safe-eval reference. 4. Run npm uninstall safe-eval.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject any input containing prototype pollution patterns like __proto__ or constructor.prototype
Use Alternative Sandbox
allReplace safe-eval with vm2 module which provides better isolation
npm uninstall safe-eval
npm install vm2
🧯 If You Can't Patch
- Implement strict input validation to reject any user input containing prototype pollution patterns
- Isolate the vulnerable component in a container or sandboxed environment with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for safe-eval dependency. Run: npm list safe-evalCheck Version:
npm list safe-evalVerify Fix Applied:
Verify safe-eval is removed from dependencies and not in node_modules. Run: npm list safe-eval and check it returns 'empty'📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript evaluation errors
- Application crashes during code evaluation
- Suspicious input patterns containing __proto__ or constructor
Network Indicators:
- Unusually large or complex payloads sent to evaluation endpoints
- Repeated requests to code evaluation endpoints
SIEM Query:
source=application_logs AND ("safeEval" OR "safe-eval") AND (error OR crash OR exception)🔗 References
- https://gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9
- https://github.com/hacksparrow/safe-eval/issues/28
- https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062
- https://gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9
- https://github.com/hacksparrow/safe-eval/issues/28
- https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062
