Bug: Remote Code Execution leads to sandbox escape.
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2024-12-07 07:44:19+00:00
Resolved: 2024-12-08 23:24:28+00:00

Bug Report: Unauthorized Execution of System Commands (Open Calculator) via Malicious Web Application
Product:
Google Chrome, Mozilla Firefox, Microsoft Edge

Versions Affected:

Google Chrome 131.0.6778.109 (Official Build) (64-bit)
Mozilla Firefox 133.0
Microsoft Edge 131.0.2903.70 (Official Build) (64-bit)
Operating System:
Windows 10 Home (64-bit)

Node.js Version:
v22.12.0 (headless server setup)

Description:
A security vulnerability has been identified where a malicious web application can bypass security mechanisms and execute system commands without user consent. This occurs via a Node.js-based server which, when accessed by a victim, triggers the execution of system commands (e.g., opening the calculator) via a child process wrapped in JavaScript.

The vulnerability exposes sensitive systems to potential exploitation, as the server can initiate unauthorized processes (like opening a calculator or other applications) without any user interaction or confirmation.

Steps to Reproduce:
Set Up Malicious Server: A headless Node.js server is created with a simple HTTP request handler. It listens for a GET request at the /open-calculator endpoint, which triggers a system command to open the calculator application.

javascript
Copy code
```js
const http = require("http");
const { exec } = require("child_process");

function openCalculator() {
  const platform = process.platform; // 'win32', 'darwin', 'linux'

  let command;
  if (platform === "win32") {
    command = "calc";
  } else if (platform === "darwin") {
    command = "open -a Calculator";
  } else if (platform === "linux") {
    command = "gnome-calculator";
  } else {
    console.error("Unsupported platform");
    return;
  }

  exec(command, (error, stdout, stderr) => {
    if (error) {
      console.error(`Error: ${error.message}`);
      return;
    }
    if (stderr) {
      console.error(`Stderr: ${stderr}`);
      return;
    }
    console.log(`Command executed: ${stdout}`);
  });
}

const server = http.createServer((req, res) => {
  if (req.method === "GET" && req.url === "/open-calculator") {
    openCalculator();
    res.writeHead(200, { "Content-Type": "text/plain" });
    res.end("Calculator opened!");
  } else {
    res.writeHead(404, { "Content-Type": "text/plain" });
    res.end("Not Found");
  }
});

const PORT = 3000;
server.listen(PORT, () => {
  console.log(`Server running on http://localhost:${PORT}`);
});
```
Access the Web Page:

When the malicious web page is accessed by the user, a system command is silently triggered by the server, opening the calculator application (or similar system command based on the platform).
Expected Behavior:
The browser should request explicit user permission before triggering any sensitive actions, such as running system commands.
System commands (e.g., opening a calculator) should not be executed in the browser environment without user interaction or consent.
Actual Behavior:
The system command is executed automatically when the user accesses the malicious web page, without any prompt for user consent, potentially exposing the system to further exploitation.
Environment:
Browsers Affected: Google Chrome 131.0.6778.109, Mozilla Firefox 133.0, Microsoft Edge 131.0.2903.70
Operating System: Windows 10 Home (64-bit)
Node.js Version: v22.12.0
Server Setup: Headless Node.js server executing system commands via JavaScript child process
Mitigation:
Browsers should ensure that JavaScript executed within the browser sandbox cannot trigger arbitrary system commands, even in the presence of server-side code.
Recommendations:
Browser vendors should enhance security mechanisms to prevent the execution of system commands through JavaScript without explicit user consent, especially in headless or server-driven environments.