Google Cloud Application Integration Sandbox Escape Vulnerability in JavaScript Task

A sandbox escape vulnerability has been identified in the JavaScript Task feature of Google Cloud Application Integration. This vulnerability allows an actor to execute arbitrary unsandboxed code by crafting specific JavaScript that is processed by the Rhino engine. Effective January 24, 2025, Google Cloud Application Integration will discontinue support for the Rhino engine, eliminating the vulnerability. Existing published JavaScript tasks can be manually migrated to use the V8 engine.

Impact

Exploitation of this vulnerability allows for arbitrary code execution outside of the intended sandbox environment, potentially leading to unauthorized actions or access within the application integration context.