rce-code-execution

Context

• Forge apps may execute user-provided code via AsyncFunction, Function(), eval(), or similar constructs. In RuntimeV2, this executes in a shared AWS Lambda context with tenant isolation risks.
• Related CWE: CWE-94 (Code Injection), CWE-95 (Eval Injection).
• Past issues: JMCF RCE Investigation - scripted fields executing user code in shared global scope.
• Severity: Critical - enables arbitrary code execution, data exfiltration, tenant data leakage.

Scope & Signals

• Dangerous APIs (same global scope - CRITICAL):
  • eval(userScript)
  • new Function('param', userScript)
  • new AsyncFunction('param', userScript) (AsyncFunction = async function(){}.constructor)
  • setTimeout(userScript, delay) with string argument
  • setInterval(userScript, delay) with string argument
• Somewhat isolated (controlled context):
  • vm.runInNewContext(script, context)
  • vm.createContext() + vm.runInContext()
• Process isolated (still risky):
  • child_process.exec(command)
  • child_process.spawn(cmd, args)

Vulnerable Patterns

// CRITICAL - User script in same global scope
const AsyncFunction = async function () {}.constructor;

export async function runUserScript(userScript, issue) {
  // User code runs in same scope, can access/modify globals
  const f = new AsyncFunction('issue', 'api', userScript);
  return await f(issue, api);
}

// CRITICAL - Direct eval
resolver.define('evaluate', async ({ payload }) => {
  return eval(payload.expression);  // Arbitrary code execution
});

// CRITICAL - Function constructor
const calculate = new Function('x', 'y', payload.formula);
const result = calculate(10, 20);

// HIGH - setTimeout with string (rarely used but dangerous)
setTimeout(payload.callback, 1000);  // If callback is a string

Lambda Warm Start Vulnerabilities

In RuntimeV2, AWS Lambda reuses containers across invocations:

// Module-level variables persist across Lambda invocations
let globalCache = {};  // Shared across tenants!

// Malicious user script can:
// 1. Pollute global scope
globalThis.__proto__.malicious = () => { /* exploit */ };

// 2. Modify module-level state
globalCache.otherTenantData = stolenData;

// 3. Override built-in functions
console.error = () => {};  // Suppress security logging

// 4. Access data from previous invocations
const previousData = globalCache.sensitiveData;

Secure Patterns

// BETTER - VM isolation (still same process but isolated context)
const vm = require('vm');

function runUserScript(userScript, context) {
  const sandbox = vm.createContext({
    issue: context.issue,
    api: restrictedApi,
    console: safeConsole
  });
  
  return vm.runInContext(userScript, sandbox, {
    timeout: 5000,  // Prevent infinite loops
    displayErrors: false
  });
}

// BEST - Use Deno subprocesses for true isolation
// Deno provides V8 sandboxing with permission controls
// https://docs.deno.com/runtime/fundamentals/security/

// RECOMMENDED - Use QuickJS for embedded execution
// QuickJS provides true memory and process isolation
import QuickJS from 'quickjs';
const vm = new QuickJS.VM();
const context = vm.createContext({ issue, api });
const result = await vm.evalCode(userScript, context);

Detection Checklist

• Search for AsyncFunction, new Function(), eval() in codebase.
• Trace the script/code argument to untrusted sources.
• Identify module-level variables that could leak between invocations.
• Check for global scope modifications in user-executable code.
• Review caches and state that persist across Lambda warm starts.

Scanning Patterns

// Pattern 1: AsyncFunction constructor
const AsyncFunction = async function () {}.constructor
new AsyncFunction('param1', 'param2', script)

// Pattern 2: Function constructor
new Function('param1', 'param2', script)

// Pattern 3: eval
eval(script)

// Pattern 4: Global state
globalThis.property = value
global.property = value