Breaking Down Three Activepieces Vulnerabilities in Code Execution Pipelines
Two High-severity findings that both execute before the isolate exists, one reflected XSS that puts attacker data inside a script block, and the timeline that explains why the V8 isolate contributed nothing to either.
When a product's premise is "write arbitrary code and we will run it safely," the sandbox is not a feature. It is the product. Everything else is a UI on top of one promise.
So the question I ask about these platforms is never whether the sandbox is any good. Sandboxes are usually fine. V8 isolates work. nsjail works. The question that actually pays is narrower:
When does it start?
A sandbox is not a property of a system. It is a line in a source file. Above that line, attacker-influenced work runs with whatever privileges the host process has. Below it, the boundary applies. Everybody audits below the line, because that is where the interesting-looking...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
