Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Google Cloud runs Application Integration in a fully managed sandbox environment. Its JavaScript task feature lets customers write JavaScript that is executed by the open-source JavaScript engine Rhino, which is written in Java. Naturally, this needs a sandbox to execute in. The post describes breaking out of the sandbox.

While testing the application, they got a Rhino-specific error message that interested them. After enumerating the file system in the chatbot, they saw two jars. To exfiltrate these, they used a myriad of console.log() (because the sandbox has no Internet access) to leak the jars in 5MB chunks. From there, they opened the jar to understand the sandbox.

The Java Security Manager was the foundation of the sandbox. When the code attempts to perform most actions, it consults the Java libraries to determine whether the action is allowed under the defined security policies. These policies define how things work. For more details on how to set this up, read through the post.

The implementation had two misconfigurations. First, COMMON_PERMISSIONS always returned true. This permission happens to include the ReflectPermission("suppressAccessChecks") permission. So, you can call setAccessible(true) on the field to mutate it through reflection. This allowed for modification of private fields, calling private methods, and modifying security-critical internal state.

Another policy grants the ability to execute the Java binary. This seems fine, but these two things paired together are enough to start the process without the sandbox. First, use reflection to modify the existing COMMON_PERMISSIONS field. This adds the modifyThread and AllPermission to it. From there, create a custom class that can be launched via the Java launcher.

With most permission checks turned off, they were able to execute arbitrary commands on the machine outside the sandbox. This had credentials for cloud-crm-ip-script-execution in the Google's Borg infrastructure. For the impact, they got a $75K bug bounty. To remediate, they use V8 instead of Rhino.

Overall, a good blog post on escaping the Java sandbox. I imagine this will be useful in the future for folks!