A critical Remote Code Execution vulnerability was discovered in the @nestjs/devtools-integration package due to an insecure JavaScript sandbox environment combined with insufficient CORS and content-type validations. This flaw allows attackers to execute arbitrary code on a developer’s local machine simply by visiting a malicious website. #nestjs #Socket #safe-eval
Keypoints
- The @nestjs/devtools-integration package exposes two endpoints on a developer’s localhost server that execute code from JSON POST requests within a sandbox using Node’s vm module.
- The sandbox mechanism relies on safe-eval, an outdated and insecure project that fails to contain arbitrary code execution.
- An attacker can bypass CORS restrictions by exploiting the server’s acceptance of text/plain content-type POST requests without proper validation, enabling Cross-Site Request Forgery (CSRF).
- A proof-of-concept payload allows code execution from a user visiting a malicious page, resulting in full Remote Code Execution (RCE) on the local machine.
- Maintainers fixed the vulnerability by adopting a more secure sandboxing library (@nyariv/sandboxjs), validating content types, checking request origin, and implementing an authentication token for connections.
- This vulnerability is facilitated by a longstanding browser flaw that enables websites to communicate with local services via the localhost interface.
- The rapid response and multi-layered mitigation strategy by the maintainers exemplify effective vulnerability management in open-source projects.
MITRE Techniques
- [T1203] Exploitation for Client Execution – Executing arbitrary code on the local machine by exploiting sandbox bypasses and CSRF via localhost endpoints (“a critical RCE vulnerability…exploitable just by visiting a malicious website”).
- [T1184] Network Sniffing – Exploiting insufficient CORS and content-type enforcement to make HTTP requests to local services from malicious sites (“the server isn’t checking the Content-Type header of the incoming request…we can run our payload”).
- [T1059] Command and Scripting Interpreter – Using the Node.js vm module and safe-eval for sandboxed code execution that can be escaped (“@nestjs/devtools-integration attempts to execute untrusted user code in a sandboxed environment established by the runInNewContext method”).
Indicators of Compromise
- [Domain] Malicious localhost endpoint – http://localhost:8000/inspector/graph/interact used for executing sandbox escape payloads.
- [File hash] Vulnerable package version in @nestjs/devtools-integration scanned by Socket’s AI-based malware detection (specific hashes not disclosed but referenced via package registry source code).
Read more: https://socket.dev/blog/nestjs-rce-vuln