Security vulnerabilities and automated fixes for sandbox escape issues
2 posts found
A path traversal flaw in the `clean_path()` helper let a user-controlled `rel_path` value escape the intended USERDATA directory and reach arbitrary files on disk. The function joined path segments without checking the final result, so `../` sequences in route parameters or query strings could be used to read or write files outside the sandboxed storage area. The fix normalizes the path and verifies it still resolves inside the USERDATA root before returning it, raising an error otherwise.
A medium-severity vulnerability in Sandboxie's kernel-level input hook allowed malicious sandboxed processes to inject keystrokes and mouse clicks into privileged windows outside the sandbox, including UAC dialogs. The fix adds proper window handle validation to ensure INPUT structures only target windows within the same sandbox boundary. This is a critical reminder that sandbox isolation must be enforced at every layer, especially at the kernel level where input events are processed.