CVE-2024-34347: @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE
(updated )
This attack gives an attacker arbitrary command execution on the machine of a victim Hoppscotch CLI user. For the attack to succeed, an attacker has to lure the victim into downloading a malicious Hoppscotch collection and running it with the Hoppscotch CLI.
This issue does not impact Hoppscotch Web or Desktop, as they use the safe web worker sandboxing approach.
References
- github.com/advisories/GHSA-qmmm-73r2-f8xr
- github.com/hoppscotch/hoppscotch
- github.com/hoppscotch/hoppscotch/commit/22c6eabd133195d22874250a5ae40cb26b851b01
- github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qmmm-73r2-f8xr
- nvd.nist.gov/vuln/detail/CVE-2024-34347
- www.sonarsource.com/blog/scripting-outside-the-box-api-client-security-risks-part-2
Code Behaviors & Features
Detect and mitigate CVE-2024-34347 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →