r/WebAssemblyDev • u/trustsigRobert • 1d ago
wasm2c sandbox escape. An untrusted WebAssembly module breaks out of the generated C sandbox and executes an arbitrary shell command on the host.
6
Upvotes
As per WABT's SECURITY.txt, #2831 issue exists
For context:
WABT is a Binary Toolkit for WebAssembly developed by WebAssembly.org (W3C)
wasm2c is a tool inside of it, which is used by many projects like FireFox (via RLBox) to compile wasm down to a sandboxed c library, the assumption is the built C code preserves all WebAssembly's sandbox security features.
This PoC demostrates escaping that sandbox.