Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Demo5 #5

Closed
wants to merge 5 commits into from
Closed

Demo5 #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d27abbf
test
Dec 7, 2023
8ec40a4
test
Dec 7, 2023
5963219
test
Dec 7, 2023
b597b39
test
Dec 7, 2023
7e602d1
test
Dec 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions app.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,5 @@
require('./lib/startup/validateDependencies')().then(() => {
const server = require('./server')
server.start()
server.stop()
})
2 changes: 1 addition & 1 deletion ctf.key
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
TRwzkRJnHOTckssAeyJbysWgP!Qc2T
TRwzkRJnHOTckssAeyJbysWgP!Qc2T
2 changes: 2 additions & 0 deletions data/datacreator.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -731,6 +731,8 @@ async function createOrders () {
const script = new VMScript(createOrders);
try {
const result = vm.run(script);
const result = vm.run(script);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk: vm2 versions before 3.9.16 are vulnerable to Improper Control Of Dynamically-Managed Code Resources allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.

Fix: Upgrade this library to at least version 3.9.16 at JS-App/package-lock.json:67635.

Reference(s): GHSA-xj72-wvfv-8985, CVE-2023-29199

Ignore this finding from ssc-d68b627b-18e0-4a15-892f-4ad0052bbd9a.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk: The package vm2 3.x before 3.9.11 is vulnerable to a sandbox bypass which enables arbitrary code to run out of the sandbox context, leading to execution on the host machine. It is recommended to upgrade to vm2 3.9.11.

Fix: Upgrade this library to at least version 3.9.11 at JS-App/package-lock.json:67635.

Reference(s): GHSA-mrgp-mrhc-5jrq, CVE-2022-36067

Ignore this finding from ssc-4035c22a-c2c2-4a3a-9bdf-5fa36b0bb1ce.


console.log("Result from VM:", result);
} catch (error) {
console.error("Error in VM:", error);
Expand Down
2 changes: 1 addition & 1 deletion package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.