A critical vulnerability has been discovered in the isolated-vm library for Node.js, posing a risk of remote code execution (RCE) on host systems. This flaw, identified as a type confusion issue, has not yet been assigned a CVE identifier but is raising significant security concerns.
Understanding Isolated-vm and Its Functionality
The isolated-vm Node.js library leverages the V8 JavaScript engine’s Isolate interface, allowing developers to create completely isolated JavaScript environments. Each Isolate operates as a separate V8 instance, managing its own memory and execution state independently.
Isolates are designed to run multiple instances of sandboxed JavaScript code on the same machine without requiring additional containers or virtual machines. This makes isolated-vm a popular choice for executing untrusted JavaScript within a V8 environment.
Details of the Vulnerability
The recently identified type confusion bug impacts the ExternalCopy function, crucial for transferring data across Isolates. As EndorLabs explains, this function serializes data in one Isolate and reconstructs it in another, utilizing a transferList to optimize performance. However, the vulnerability arises from iterating over the transferList JavaScript array, which can lead to a time-of-check/time-of-use (TOCTOU) flaw.
This flaw allows attackers to manipulate the data transfer, potentially dereferencing a pointer they control. While the ExternalCopy constructor is host-accessible, a guest can exploit the ivm.Reference mechanism to create a malicious transferList, triggering the vulnerability and leading to potential RCE.
Impact and Mitigation
Exploiting this vulnerability could result in a denial-of-service attack or a control-flow hijack of the host process, escalating to RCE. The isolated-vm advisory emphasizes that any system running untrusted code within an Isolate and sharing a Reference is at risk.
Patches have been released in isolated-vm versions 6.2.0 and 7.0.1 to mitigate this vulnerability. These updates prevent user JavaScript execution during data copying, addressing the underlying issue in the native C++ binding layer.
EndorLabs highlights that the vulnerability stemmed from unchecked casts within memory-unsafe code, which mishandled raw V8 handles and pointers during sensitive operations.
As cybersecurity threats evolve, it remains crucial for developers and organizations to keep their systems updated with the latest security patches to mitigate risks associated with such vulnerabilities.
