RCE via vm2 sandbox escape in mock data generation (Tree.TreeToTemplate / TemplateToData)

Affected versions: confirmed on commit master (2.9.0), with the pinned vm2@^3.8.4 dependency.

Summary

Tree.TreeToTemplate() and Tree.TemplateToData() in src/routes/utils/tree.ts run Property.value strings through vm2's vm.run() when building interface mock templates/data. Property.value is set by any project member through the ordinary property editor, and the resulting output is served by the public, unauthenticated /app/mock/data/:interfaceId and /app/mock/template/:interfaceId routes. [email protected] is affected by multiple public, unfixed sandbox-escape CVEs (CVE-2022-36067, CVE-2023-37466, CVE-2023-37903), and the vm2 project has since been discontinued because these issues are architecturally unfixable. Any project member who can set a Property.value on an interface can therefore run arbitrary shell commands as the server process, triggered by any unauthenticated request to that interface's mock endpoint.

Details

TreeToTemplate() evaluates Property.value for the Object, Array, and bracket-array-rule cases via vm.run((${item.value})), and for Function/RegExp types via vm.run('(' + item.value + ')'), inside a new VM({ sandbox: {}, timeout: 3000 }). TemplateToData() similarly runs vm.run('mock(template)') inside its own VM instance. Both call sites use [email protected], which predates the fixes for CVE-2022-36067, CVE-2023-37466 and CVE-2023-37903 — all of which achieve full sandbox escape and host code execution from inside a default vm2.VM instance with no special options required.

The routes that trigger this (src/routes/mock.ts) are mounted with no authentication check:

router.get('/app/mock/template/:interfaceId', ...)
router.all('/app/mock/data/:interfaceId', ...)

So the practical attack is: a project member (any registered user with edit access to a repository's interfaces) sets an interface property's value to a vm2 sandbox-escape payload, and any subsequent request to that interface's mock endpoint (which requires no login, since mock endpoints exist to be called by external client applications) executes the payload with the privileges of the Node.js server process.

POC

(available upon request)

Impact

Remote code execution on the server hosting rap2-delos, exploitable by any authenticated project member (no admin privileges required) and triggered by any unauthenticated request to the affected interface's mock endpoint. This affects confidentiality, integrity and availability of the whole host, not just the application's own data.