CVE-2023-26919
📋 TL;DR
This vulnerability allows attackers to escape the JavaScript sandbox in delight-nashorn-sandbox versions 0.2.4 and 0.2.5, enabling them to invoke exit and quit methods to terminate the Java process. Applications using these vulnerable versions with allowExitFunctions set to false are affected, potentially leading to denial of service.
💻 Affected Systems
- delight-nashorn-sandbox
📦 What is this software?
Nashorn Sandbox by Javadelight
Nashorn Sandbox by Javadelight
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through Java process termination, potentially disrupting critical business functions or enabling further attacks by crashing security controls.
Likely Case
Application crashes leading to service disruption, requiring manual restart and causing temporary downtime.
If Mitigated
Limited impact if proper input validation and sandbox configuration are in place, though risk remains if vulnerable version is used.
🎯 Exploit Status
Exploit requires ability to execute JavaScript within the sandbox, but the sandbox escape itself is straightforward once code execution is achieved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.2.6
Vendor Advisory: https://github.com/javadelight/delight-nashorn-sandbox/issues/135
Restart Required: Yes
Instructions:
1. Update delight-nashorn-sandbox dependency to version 0.2.6 or later. 2. Update your project's build configuration (pom.xml for Maven, build.gradle for Gradle). 3. Rebuild and redeploy the application. 4. Restart affected services.
🔧 Temporary Workarounds
Disable loadWithNewGlobal function
allPrevent use of the vulnerable loadWithNewGlobal function in sandbox configuration
Sandbox sandbox = new Sandbox();
sandbox.allowNoBraces(false);
sandbox.allowLoadFunctions(false);
🧯 If You Can't Patch
- Implement strict input validation to prevent malicious JavaScript from reaching the sandbox
- Deploy application behind WAF with JavaScript execution blocking rules
🔍 How to Verify
Check if Vulnerable:
Check project dependencies for delight-nashorn-sandbox version 0.2.4 or 0.2.5Check Version:
mvn dependency:tree | grep delight-nashorn-sandbox OR gradle dependencies | grep delight-nashorn-sandboxVerify Fix Applied:
Verify delight-nashorn-sandbox version is 0.2.6 or higher in dependencies📡 Detection & Monitoring
Log Indicators:
- Java process termination logs
- Application crash logs with exit code 0
- Unexpected service restarts
Network Indicators:
- Sudden loss of connectivity to affected service
- HTTP 503 errors from load balancers
SIEM Query:
source="application.logs" AND ("exit" OR "quit") AND process="java"