Hoppscotch CLI sandbox escape through Node vm pre-request scripts (CVE-2024-34347)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledpackages/hoppscotch-cli/src/commands/test.ts:14

   test

2. 1
   Step 01packages/hoppscotch-cli/src/commands/test.ts:14-20

   The CLI test command parses an attacker-supplied collection file and sends its requests through the collection runner.

   export const test = (path: string, options: TestCmdOptions) => async () => {
     const envs = options.env ? await parseEnvsData(options.env) : <HoppEnvs>{ global: [], selected: [] }
     const collections = await parseCollectionData(path)
   
     const report = await collectionsRunner({ collections, envs, delay })
   }
   

3. 2
   Step 02packages/hoppscotch-cli/src/utils/pre-request.ts:36-47

   For every request, the CLI passed the collection-controlled preRequestScript string into runPreRequestScript from @hoppscotch/js-sandbox/node.

   export const preRequestScriptRunner = (request: HoppRESTRequest, envs: HoppEnvs) =>
     pipe(
       TE.of(request),
       TE.chain(({ preRequestScript }) =>
         runPreRequestScript(preRequestScript, envs)
       )
     )
   

4. 3
   Step 03packages/hoppscotch-js-sandbox/src/pre-request/node-vm/index.ts:13-31 (before fix)

   The vulnerable Node implementation created a vm context, injected host-created pw, atob, and btoa references, then executed the untrusted script text in that context.

   return createContext()
   
   const { pw, updatedEnvs } = getPreRequestScriptMethods(envs)
   
   context.pw = pw
   context.atob = atob
   context.btoa = btoa
   
   runInContext(preRequestScript, context)
   

5. 4
   Step 04packages/hoppscotch-js-sandbox/src/test-runner/node-vm/index.ts:42-50 (before fix)

   Test scripts had the same trust-boundary break: the host-created pw object plus response data were exposed directly to untrusted testScript code before runInContext.

   const { pw, testRunStack, updatedEnvs } = getTestRunnerScriptMethods(envs)
   
   context.pw = { ...pw, response: responseObjHandle.right }
   context.atob = atob
   context.btoa = btoa
   
   runInContext(testScript, context)
   

6. 5
   Step 05packages/hoppscotch-js-sandbox/src/node/pre-request.ts:20-70 (fix)

   The patched implementation creates an isolated-vm isolate and context, copies serialized API methods into the isolate, builds an in-isolate proxy, and runs the script inside that isolate.

   const isolate: ivmT.Isolate = new ivm.Isolate()
   const context = await isolate.createContext()
   const jail = context.global
   
   const { pw, updatedEnvs } = getPreRequestScriptMethods(envs)
   const serializedAPIMethods = getSerializedAPIMethods(pw)
   jail.setSync("serializedAPIMethods", serializedAPIMethods, { copy: true })
   
   const finalScript = `
     const pw = new Proxy(serializedAPIMethods, {
       get: (pwObjTarget, pwObjProp) => {
         const topLevelEntry = pwObjTarget[pwObjProp]
   
         // "pw.env" set of API methods
         if (topLevelEntry && typeof topLevelEntry === "object") {
           return new Proxy(topLevelEntry, {
             get: (subTarget, subProp) => {
               const subLevelProperty = subTarget[subProp]
               if (subLevelProperty && subLevelProperty.typeof === "function") {
                 return (...args) => subLevelProperty.applySync(null, args)
               }
             },
           })
         }
       }
     })
   
     ${preRequestScript}
   `
   
   const script = await isolate.compileScript(finalScript)
   await script.run(context)
   

7. 6
   Step 06packages/hoppscotch-js-sandbox/src/node/utils.ts:6-23

   Host API functions are converted to isolated-vm references recursively instead of passing a raw host object graph into a Node vm context.

   export const getSerializedAPIMethods = (
     namespaceObj: Record<string, unknown>
   ): Record<string, unknown> => {
     const result: Record<string, unknown> = {}
   
     for (const [key, value] of Object.entries(namespaceObj)) {
       if (typeof value === "object" && value !== null && !Array.isArray(value)) {
         result[key] = getSerializedAPIMethods(value as Record<string, unknown>)
       } else if (typeof value === "function") {
         result[key] = new ivm.Reference(value)
       } else {
         result[key] = value
       }
     }
   
     return result
   }
   

8. Sinkpackages/hoppscotch-js-sandbox/src/pre-request/node-vm/index.ts:31

   runInContext