Open
Conversation
Collaborator
Author
🔗 Additional ContextOriginal Blog Post: https://0xdf.gitlab.io/2026/01/31/htb-codetwo.html Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> (new page) Js2Py sandbox escape (CVE-2024-28397) / Python-backed JavaScript sandboxes OR Generic Methodologies & Resources -> Python Sandbox Escape & Pyscript (if positioning it as a Python sandbox escape via Js2Py)". Repository Maintenance:
Review Notes:
Bot Version: HackTricks News Bot v1.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 Automated Content Update
This PR was automatically generated by the HackTricks News Bot based on a technical blog post.
📝 Source Information
🎯 Content Summary
What this post covers
Walkthrough of Hack The Box CodeTwo (Linux, Easy): a Flask + Gunicorn web app provides an authenticated “developer sandbox” that executes user-supplied JavaScript via Js2Py. The core issue is that evaluating attacker-controlled JS through Js2Py can be escaped to Python and then to OS command execution using CVE-2024-28397.
End-to-end chain described by the author:
1) Enumerate services (SSH + web app on 8000).
2) Register/login and obser...
🔧 Technical Details
Js2Py sandbox escape (CVE-2024-28397): If an application evaluates attacker-controlled JavaScript using
js2py.eval_js(...), an attacker can escape the intended sandbox even whenjs2py.disable_pyimport()is enabled by abusing Python object internals exposed through Js2Py wrappers. A practical chain is: obtain a Python-backed object viaObject.getOwnPropertyNames({})(observed asdict_keys([])), grab.__getattribute__, use it to access"__class__", pivot to the Python baseobjectvia.__base__, enumerateobject.__subclasses__(), and search for dangerous classes likesubprocess.Popen(__module__ == "subprocess"and__name__ == "Popen"). InstantiatingPopen(cmd, ...)and calling.communicate()yields OS command execution and output, resulting in RCE inside the hosting Python process.Reproduction/debugging trick: Use uv to quickly recreate the exact vulnerable environment with pinned versions and a compatible interpreter: `uv run --with js2py==0.74 ...
🤖 Agent Actions
Summary:
Tests:
This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.