NocoBase CVE-2024-84150 VM Sandbox Escape to RCE via Prototype Chain Traversal

Vulnerability Overview Vulnerability Name: VM Sandbox Escape to Remote Code Execution via console._stdout Prototype Chain Traversal in Workflow Script Node CVE ID: CVE-2024-84150 CVSS Score: 10.0 / 10 (Critical) Vulnerability Principle: NocoBase Workflow Script Node executes user-provided JavaScript code in a Node.js VM sandbox. Although a custom require allowlist is used (controlled by the environment variable), the object passed into the sandbox context exposes the host environment's stream objects through and . Attackers can bypass sandbox restrictions via prototype chain traversal to achieve remote code execution. Exploitation Chain: 1. → Obtain the host realm's Function constructor 2. → Obtain the Node.js process object 3. → Load modules without restrictions 4. → Execute RCE as root --- Affected Scope Attack Impact: Remote code execution as root (uid=0) within Docker containers Database credential theft ( , , and other environment variables) Arbitrary file reading via Reverse shell confirmed obtainable Outbound network access for lateral movement --- POC Code HTTP Request Response --- Remediation 1. Replace VM Module: Replace the Node.js module with to achieve true V8 isolation separation 2. Sanitize Proxy Objects: Do not pass the host object directly into the sandbox; create clean proxy objects 3. Run with Reduced Privileges: Run the application as a non-root user 4. Restrict Permissions: Limit to administrator role access only --- Alternative Escape Vectors (same exploitation chain via stderr) + (V8 CallSite API)

Goal Reached Thanks to every supporter — we hit 100%!

NocoBase CVE-2024-84150 VM Sandbox Escape to RCE via Prototype Chain Traversal

More from this source