nodebox

Node.js permission model bypass!

• Permissions:
  • --allow-fs-read=/sandbox
  • --allow-fs-write=/sandbox
• Hardening:
  • --jitless
  • --freeze-flags-after-init
  • --frozen-intrinsics
  • Remove access to node:sqlite, node:ffi, and internal modules
• Goal:
  • RCE

Note: Although unintended, this challenge may be solvable using a binary exploitation approach. However, the intended solution does not rely on any memory-safety bugs.