CVE-2024-34347: @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE
Description
@hoppscotch/cli is a CLI to run Hoppscotch Test Scripts in CI environments. Prior to 0.8.0, the @hoppscotch/js-sandbox package provides a Javascript sandbox that uses the Node.js vm module. However, the vm module is not safe for sandboxing untrusted Javascript code. This is because code inside the vm context can break out if it can get a hold of any reference to an object created outside of the vm. In the case of @hoppscotch/js-sandbox, multiple references to external objects are passed into the vm context to allow pre-request scripts interactions with environment variables and more. But this also allows the pre-request script to escape the sandbox. This vulnerability is fixed in 0.8.0.
Classification
CVE ID: CVE-2024-34347
CVSS Base Severity: HIGH
CVSS Base Score: 8.4
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Problem Types
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')Affected Products
Vendor: hoppscotch
Product: hoppscotch
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.09% (probability of being exploited)
EPSS Percentile: 27.52% (scored less or equal to compared to others)
EPSS Date: 2025-06-21 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: poc
SSVC Technical Impact: total
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-34347https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qmmm-73r2-f8xr
https://github.com/hoppscotch/hoppscotch/commit/22c6eabd133195d22874250a5ae40cb26b851b01
https://www.sonarsource.com/blog/scripting-outside-the-box-api-client-security-risks-part-2