Happy DOM Vulnerability Exposes 2.7 Million Users To Remote Code Execution Attacks

A security vulnerability has been identified in Happy DOM, a widely used JavaScript DOM implementation, impacting versions up to v19.

This vulnerability exposes systems to Remote Code Execution (RCE) attacks, affecting approximately 2.7 million weekly users of the package.

The issue arises due to the Node.js VM Context used by Happy DOM, which is not entirely isolated, allowing untrusted code to escape and access the underlying system's functionalities.

JavaScript evaluation is enabled by default in Happy DOM, which can pose a security risk when executing untrusted code. This configuration allows an attacker to craft malicious JavaScript to traverse the constructor chain and access the process-level Function constructor.

This capability enables executing code outside the intended sandbox environment, leading to a complete VM escape.

The type of module system, CommonJS or ESM, affects the attacker's control. In a CommonJS environment, attackers can access the require() function to load Node.js modules and perform unauthorized actions.

This vulnerability has significant implications, particularly for applications using Server-Side Rendering (SSR) or testing frameworks that process external content.

Possible outcomes of successful exploitation include:

Data Exfiltration : Accessing sensitive information such as environment variables and configuration files. Lateral Movement : Using network access to connect to other internal systems, bypassing certain network protections. Code Execution : Running arbitrary commands on the server by obtaining child process access. Persistence : Modifying the file system to maintain a long-term presence on the system.

Developers of Happy DOM have released a patched version to address this vulnerability. It is strongly recommended for users to promptly update to Happy DOM v20 or newer.

The updated version disables JavaScript evaluation by default and issues a warning if enabled in an insecure environment.

For those requiring JavaScript evaluation, it is imperative to run Node.js with the --disallow-code-generation-from-strings flag, preventing eval() and Function() usage at the process level to close the VM escape loophole.

If an immediate update is not feasible, developers should manually disable JavaScript evaluation unless processing content from a fully trusted source.

Based on reporting by Cyber Security News.