A Js2Py Python package, which was downloaded 1.2 million times last month, has a vulnerability (CVE-2024-28397) that allows bypassing the sandbox isolation and executing code on the system when processing specially crafted JavaScript data. This vulnerability can be used to attack programs that use Js2Py to run JavaScript code. A patch is currently available only as a patch. An exploit prototype has been prepared to test the attack possibility.
The Js2Py package implements an interpreter and compiler for JavaScript, allowing JavaScript code to run in isolation virtuális gépben or translate JavaScript into Python representations. The project is entirely written in Python and does not use third-party JavaScript engines. In practice, the library is used in various web indexers, download systems, and site analyzers that support processing content generated by JavaScript code.
Among the applications affected by the vulnerability, Lightnovel Crawler (a utility for downloading books from online services and saving them in various formats for offline reading), cloudscraper (automatically bypasses bot protection pages used in the Cloudflare CDN), and pyLoad (a download manager that supports processing pages generated in JavaScript) are notable. When processing specially crafted JavaScript content in these applications, an attacker may achieve arbitrary code execution at the system level.
The vulnerability exists in the implementation of a global variable within js2py, allowing access to a Python object from JavaScript code executed in an isolated environment, regardless of the call to js2py.disable_pyimport() method to disable Python object imports. An attacker can exploit the vulnerability to gain access to the Popen object from the Python subprocess module to execute arbitrary code on the system. Notably, a fix addressing the vulnerability was submitted to the Js2Py project on March 1, but it has not been accepted in three and a half months.
Forrás: opennet.ru
