Description

vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary

Summary

A sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution.

When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including:

Performing identity checks using host-side WeakMap

Mutating host object state from inside the sandbox

This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object.

As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation.

Details

In setup-sandbox.js, vm2 wraps Promise.prototype.then:

globalPromise.prototype.then = function then(onFulfilled, onRejected) {
  resetPromiseSpecies(this);

  if (typeof onFulfilled === 'function') {
    const origOnFulfilled = onFulfilled;
    onFulfilled = function onFulfilled(value) {
      value = ensureThis(value);
      return apply(origOnFulfilled, this, [value]);...
Show more

Mitigation

Aliases

References