PT-2023-20847 · Unknown · Delight Nashorn Sandbox

Published 2023-04-10 · Updated 2025-02-11 · CVE-2023-26919

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions delight-nashorn-sandbox versions 0.2.4 through 0.2.5

Description The issue allows for sandbox escape when allowExitFunctions is set to false. The loadWithNewGlobal function can be used to invoke the exit and quit methods, leading to the exit of the Java process.

Recommendations For delight-nashorn-sandbox versions 0.2.4 and 0.2.5, consider setting allowExitFunctions to true to prevent the invocation of the exit and quit methods. As a temporary workaround, restrict the use of the loadWithNewGlobal function until a patch is available.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-26919

Affected Products

Delight Nashorn Sandbox

References · 7

• 🔥 https://github.com/javadelight/delight-nashorn-sandbox/issues/135 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-26919 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26919 · Vendor Advisory
• https://t.me/cvenotify/48254 · Telegram Post
• https://t.me/cvenotify/110888 · Telegram Post
• https://t.me/cibsecurity/61781 · Telegram Post
• https://t.me/cvenotify/47890 · Telegram Post