Contents
V5339. OWASP. Potential RCE vulnerability. Insecure GraalVM context is used to process potentially tainted data.
The analyzer has detected an insecurely configured Polyglot Context (GraalVM), which could execute a malicious script. Such configuration may make the application vulnerable to Remote Code Execution (RCE). You can find a more detailed explanation of the vulnerability here.
This vulnerability can be categorized under the OWASP Top 10 Application Security Risks classification as follows:
Look at a simple example involving the unsafe setting in Context.Builder:
public void evalScript(String script) {
try (Context c = Context.newBuilder()
.allowAllAccess(true)
.build()
) {
c.eval("js", script);
}
}The Context.eval method receives unverified JavaScript code obtained from the public method parameter. Since the method is public, it may receive unverified external data from controllers, forms, user input, or others.
Using the unsafe .allowAllAccess(true) setting grants the created Context permission to call all public host constructors and methods.
A combination of an unchecked script and dangerous settings creates the risk for remote execution of arbitrary code. For example, an attacker can execute the rm -rf / command using the following script:
runtime = Java.type('java.lang.Runtime');
runtime.getRuntime().exec("rm -rf /");To improve security and prevent remote execution of arbitrary code, it is recommended to restrict host access.
If the script does not need to call host methods, disable access entirely using .allowAllAccess(false):
public void evalScript(String script) {
try (Context c = Context.newBuilder()
.allowAllAccess(false)
.build()
) {
c.eval("js", script);
}
}If you need access to the host API, use the HostAccess.EXPLICIT setting, which allows access only to class members annotated with @Export. To define a list of classes that can be looked up directly, use Builder.allowClassLookup.
The following is an example of a context configured using this approach:
public void evalScript(String script) {
try (Context c = Context.newBuilder()
.allowHostClassLookup(clazz ->
clazz.startsWith("com.example.api")
)
.allowAllAccess(false)
.allowHostAccess(HostAccess.EXPLICIT)
.build()
) {
c.eval("js", script);
}
}In the example, only classes annotated with @Export can be used, and only classes from the com.example.api package can be obtained via Java.type(....).
This diagnostic is classified as:
|
Was this page helpful?
