CVE-2023-39532
📋 TL;DR
CVE-2023-39532 is a critical vulnerability in SES (Secure ECMAScript) that allows guest programs running in Compartments to bypass confinement and access the host's dynamic import functionality. This can lead to information exfiltration or arbitrary code execution depending on the environment configuration. Affected users include those running SES versions 0.13.0-0.18.0 without proper Content-Security-Policy controls.
💻 Affected Systems
- SES (Secure ECMAScript)
📦 What is this software?
Ses by Agoric
Ses by Agoric
Ses by Agoric
Ses by Agoric
Ses by Agoric
Ses by Agoric
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution, allowing attackers to exfiltrate sensitive data, install malware, or pivot to other systems.
Likely Case
Information exfiltration through HTTP requests to attacker-controlled domains, potentially leaking session tokens, credentials, or application data.
If Mitigated
Limited impact with proper Content-Security-Policy restricting module imports to trusted origins only.
🎯 Exploit Status
Exploit uses simple JavaScript syntax: {...import(arbitraryModuleSpecifier)}. Attackers can leverage dynamic import to bypass confinement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.18.7, 0.17.1, 0.16.1, 0.15.24, 0.14.5, 0.13.5
Vendor Advisory: https://github.com/endojs/endo/security/advisories/GHSA-9c4h-3f7h-322r
Restart Required: Yes
Instructions:
1. Update SES package to patched version using npm update @endo/ses or yarn upgrade @endo/ses. 2. Restart application/service. 3. Verify version matches patched release.
🔧 Temporary Workarounds
Content-Security-Policy (Web)
allImplement strict CSP to restrict dynamic imports to trusted origins only.
Content-Security-Policy: script-src 'self'; connect-src 'self'
XS Runtime Module Restriction
linuxBuild XS binary without runtime module loading capability by implementing fxFindModule to call fxRejectModuleFile.
🧯 If You Can't Patch
- Implement strict Content-Security-Policy headers for web applications
- Isolate SES compartments in sandboxed environments with network restrictions
🔍 How to Verify
Check if Vulnerable:
Check package.json for SES version or run: npm list @endo/ses | grep @endo/sesCheck Version:
npm list @endo/ses | grep @endo/sesVerify Fix Applied:
Verify installed version is 0.18.7, 0.17.1, 0.16.1, 0.15.24, 0.14.5, or 0.13.5📡 Detection & Monitoring
Log Indicators:
- Unexpected dynamic import patterns in JavaScript execution logs
- Unusual HTTP requests from application to external domains
Network Indicators:
- Outbound connections to unexpected domains following dynamic import patterns
- Data exfiltration via URL parameters
SIEM Query:
source="application_logs" AND ("dynamic import" OR "import(") AND NOT domain IN [trusted_domains]