eval()的RCE漏洞

Description

A Remote Code Execution (RCE) vulnerability has been identified in Sea.js due to the use of eval() in certain parts of the codebase. The eval() function is used to dynamically execute JavaScript code, which poses a security risk if user-controlled input reaches this function. This could lead to arbitrary code execution, allowing an attacker to run malicious code remotely.

Affected Version

Sea.js vX.X.X (and possibly earlier versions)

Steps to Reproduce

1. The vulnerability occurs when untrusted input is passed to the eval() function in the code.
2. An attacker can craft a payload that is passed to eval(), leading to arbitrary code execution.

Impact

This vulnerability allows attackers to execute arbitrary JavaScript code, leading to potential full compromise of the system running Sea.js.

Suggested Fix

• Avoid using eval() completely.
• Consider using safer alternatives like JSON.parse() or Function() to handle dynamic code execution safely.