Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| praisonai | npm | <= 1.7.1 | 1.7.2 |
Miggo AIRoot Cause AnalysisThe vulnerability analysis identified three main areas of concern related to remote code execution. The primary vulnerability, as described in the CVE, is within the codeMode function located in src/praisonai-ts/src/tools/builtins/code-mode.ts. This function used the new Function() constructor with a with statement, which is a known insecure practice for sandboxing JavaScript code. An attacker could easily escape the sandbox and gain access to the Node.js global object, allowing for arbitrary code execution. The patch correctly replaces this with runInNewContext from the vm module for a more secure sandbox.
Additionally, two other functions were identified as vulnerable. The shell function in src/praisonai-ts/src/tools/utility-tools.ts used child_process.exec, which is susceptible to shell injection. The SandboxExecutor.execute method in src/praisonai-ts/src/cli/features/sandbox-executor.ts also indirectly used a vulnerable pattern by spawning a shell to execute commands. Both of these were patched to use child_process.spawn with the shell: false option, which is the recommended practice to prevent command injection vulnerabilities.
codeModesrc/praisonai-ts/src/tools/builtins/code-mode.ts
shellsrc/praisonai-ts/src/tools/utility-tools.ts
SandboxExecutor.executesrc/praisonai-ts/src/cli/features/sandbox-executor.ts