CVE-2024-34347: @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE
(updated )
This attack gives an attacker arbitrary command execution on the machine of a victim Hoppscotch CLI user. For the attack to succeed, an attacker has to lure the victim into downloading a malicious Hoppscotch collection and running it with the Hoppscotch CLI.
This issue does not impact Hoppscotch Web or Desktop, as they use the safe web worker sandboxing approach.
References
- github.com/advisories/GHSA-qmmm-73r2-f8xr
- github.com/hoppscotch/hoppscotch
- github.com/hoppscotch/hoppscotch/commit/22c6eabd133195d22874250a5ae40cb26b851b01
- github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qmmm-73r2-f8xr
- nvd.nist.gov/vuln/detail/CVE-2024-34347
- www.sonarsource.com/blog/scripting-outside-the-box-api-client-security-risks-part-2
Code Behaviors & Features
Detect and mitigate CVE-2024-34347 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →