{"id":1097,"date":"2026-04-24T08:05:53","date_gmt":"2026-04-24T01:05:53","guid":{"rendered":"https:\/\/vncybers.vn\/lo-hong-sandbox-cohere-ai-cho-phep-thoat-container-chay-lenh-root\/"},"modified":"2026-04-24T08:06:18","modified_gmt":"2026-04-24T01:06:18","slug":"lo-hong-sandbox-cohere-ai-cho-phep-thoat-container-chay-lenh-root","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/lo-hong-sandbox-cohere-ai-cho-phep-thoat-container-chay-lenh-root\/","title":{"rendered":"L\u1ed7 h\u1ed5ng sandbox c\u1ee7a Cohere AI cho ph\u00e9p tho\u00e1t container v\u00e0 ch\u1ea1y l\u1ec7nh root"},"content":{"rendered":"
\"L\u1ed7<\/figure>\n\n\n\n

M\u1ed9t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt nghi\u00eam tr\u1ecdng v\u1eeba \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 trong Terrarium<\/strong>, c\u00f4ng c\u1ee5 sandbox Python m\u00e3 ngu\u1ed3n m\u1edf do Cohere AI ph\u00e1t tri\u1ec3n, \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 th\u1ef1c thi code t\u1ea1o b\u1edfi c\u00e1c m\u00f4 h\u00ecnh ng\u00f4n ng\u1eef l\u1edbn (LLM). V\u1edbi \u0111i\u1ec3m CVSS 9.3, l\u1ed7 h\u1ed5ng CVE-2026-5752 cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng tho\u00e1t ho\u00e0n to\u00e0n kh\u1ecfi sandbox, th\u1ef1c thi l\u1ec7nh t\u00f9y \u00fd v\u1edbi quy\u1ec1n root b\u00ean trong container, th\u1eadm ch\u00ed c\u00f3 nguy c\u01a1 ti\u1ebfp c\u1eadn m\u1ea1ng n\u1ed9i b\u1ed9 m\u00e0 kh\u00f4ng c\u1ea7n b\u1ea5t k\u1ef3 t\u01b0\u01a1ng t\u00e1c ng\u01b0\u1eddi d\u00f9ng n\u00e0o.<\/p>\n\n\n\n

Terrarium l\u00e0 g\u00ec v\u00e0 v\u00ec sao n\u00f3 \u0111\u01b0\u1ee3c d\u00f9ng?<\/h2>\n\n\n\n

Terrarium l\u00e0 d\u1ef1 \u00e1n m\u00e3 ngu\u1ed3n m\u1edf do Cohere AI ph\u00e1t tri\u1ec3n, \u0111\u01b0\u1ee3c tri\u1ec3n khai d\u01b0\u1edbi d\u1ea1ng Docker container nh\u1eb1m cung c\u1ea5p m\u00f4i tr\u01b0\u1eddng th\u1ef1c thi code an to\u00e0n cho c\u00e1c \u1ee9ng d\u1ee5ng AI. N\u1ec1n t\u1ea3ng s\u1eed d\u1ee5ng Pyodide<\/strong>, m\u1ed9t b\u1ea3n ph\u00e2n ph\u1ed1i Python ch\u1ea1y tr\u00ean WebAssembly trong m\u00f4i tr\u01b0\u1eddng Node.js, cho ph\u00e9p th\u1ef1c thi c\u00e1c g\u00f3i Python ti\u00eau chu\u1ea9n trong sandbox. Terrarium \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1eb7c bi\u1ec7t cho k\u1ecbch b\u1ea3n m\u00e0 LLM t\u1ea1o ra code v\u00e0 c\u1ea7n ch\u1ea1y th\u1ef1c thi code \u0111\u00f3 trong m\u00f4i tr\u01b0\u1eddng ki\u1ec3m so\u00e1t, gi\u00fap c\u00e1ch ly r\u1ee7i ro kh\u1ecfi h\u1ec7 th\u1ed1ng ch\u1ee7. D\u1ef1 \u00e1n \u0111\u00e3 \u0111\u1ea1t 312 sao v\u00e0 56 l\u01b0\u1ee3t fork tr\u00ean GitHub tr\u01b0\u1edbc khi ng\u1eebng ph\u00e1t tri\u1ec3n t\u00edch c\u1ef1c.<\/p>\n\n\n\n

B\u1ea3n ch\u1ea5t c\u1ee7a l\u1ed7 h\u1ed5ng: Prototype chain traversal<\/h2>\n\n\n\n

Theo ph\u00e2n t\u00edch c\u1ee7a CERT\/CC (VU#414811), nguy\u00ean nh\u00e2n g\u1ed1c r\u1ec5 n\u1eb1m trong c\u00e1ch c\u1ea5u h\u00ecnh \u0111\u1ed1i t\u01b0\u1ee3ng jsglobals trong file service.ts. C\u1ee5 th\u1ec3, \u0111\u1ed1i t\u01b0\u1ee3ng mock document \u0111\u01b0\u1ee3c t\u1ea1o b\u1eb1ng object literal JavaScript th\u00f4ng th\u01b0\u1eddng, v\u1ed1n k\u1ebf th\u1eeba thu\u1ed9c t\u00ednh t\u1eeb Object.prototype. Chu\u1ed7i k\u1ebf th\u1eeba n\u00e0y cho ph\u00e9p code b\u00ean trong sandbox leo thang l\u00ean function constructor, t\u1ea1o ra m\u1ed9t function tr\u1ea3 v\u1ec1 globalThis, t\u1eeb \u0111\u00f3 truy c\u1eadp v\u00e0o c\u00e1c th\u00e0nh ph\u1ea7n n\u1ed9i b\u1ed9 c\u1ee7a Node.js bao g\u1ed3m require().<\/p>\n\n\n\n

SentinelOne m\u00f4 t\u1ea3 c\u1ee5 th\u1ec3: “Sandbox kh\u00f4ng ng\u0103n ch\u1eb7n \u0111\u1ea7y \u0111\u1ee7 vi\u1ec7c truy c\u1eadp v\u00e0o prototype c\u1ee7a \u0111\u1ed1i t\u01b0\u1ee3ng cha ho\u1eb7c to\u00e0n c\u1ee5c, cho ph\u00e9p code sandbox tham chi\u1ebfu v\u00e0 thao t\u00fang c\u00e1c \u0111\u1ed1i t\u01b0\u1ee3ng trong m\u00f4i tr\u01b0\u1eddng host. K\u1ef9 thu\u1eadt prototype pollution ho\u1eb7c traversal n\u00e0y v\u01b0\u1ee3t qua ranh gi\u1edbi b\u1ea3o m\u1eadt d\u1ef1 ki\u1ebfn c\u1ee7a sandbox.”<\/p>\n\n\n\n

M\u1ee9c \u0111\u1ed9 \u1ea3nh h\u01b0\u1edfng: Th\u1ef1c thi l\u1ec7nh root, ti\u1ebfp c\u1eadn m\u1ea1ng n\u1ed9i b\u1ed9<\/h2>\n\n\n\n

Khai th\u00e1c th\u00e0nh c\u00f4ng l\u1ed7 h\u1ed5ng cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c hi\u1ec7n:<\/p>\n\n\n\n

    \n
  • Th\u1ef1c thi l\u1ec7nh h\u1ec7 th\u1ed1ng t\u00f9y \u00fd v\u1edbi quy\u1ec1n root b\u00ean trong container.<\/li>\n
  • \u0110\u1ecdc v\u00e0 s\u1eeda \u0111\u1ed5i c\u00e1c file nh\u1ea1y c\u1ea3m nh\u01b0 \/etc\/passwd v\u00e0 bi\u1ebfn m\u00f4i tr\u01b0\u1eddng.<\/li>\n
  • Ti\u1ebfp c\u1eadn c\u00e1c d\u1ecbch v\u1ee5 kh\u00e1c trong m\u1ea1ng n\u1ed9i b\u1ed9 c\u1ee7a container, bao g\u1ed3m database v\u00e0 API n\u1ed9i b\u1ed9.<\/li>\n
  • C\u00f3 nguy c\u01a1 tho\u00e1t kh\u1ecfi container v\u00e0 leo thang \u0111\u1eb7c quy\u1ec1n xa h\u01a1n tr\u00ean h\u1ec7 th\u1ed1ng host.<\/li>\n<\/ul>\n\n\n\n

    \u0110i\u1ec3m \u0111\u00e1ng lo ng\u1ea1i l\u00e0 l\u1ed7 h\u1ed5ng kh\u00f4ng y\u00eau c\u1ea7u b\u1ea5t k\u1ef3 t\u01b0\u01a1ng t\u00e1c ng\u01b0\u1eddi d\u00f9ng n\u00e0o<\/strong> v\u00e0 kh\u00f4ng c\u1ea7n \u0111\u1eb7c quy\u1ec1n cao \u0111\u1ec3 khai th\u00e1c. K\u1ebb t\u1ea5n c\u00f4ng ch\u1ec9 c\u1ea7n quy\u1ec1n truy c\u1eadp c\u1ee5c b\u1ed9 v\u00e0o h\u1ec7 th\u1ed1ng l\u00e0 \u0111\u1ee7. \u0110\u00e2y l\u00e0 y\u1ebfu t\u1ed1 ch\u00ednh khi\u1ebfn CVE-2026-5752 \u0111\u1ea1t \u0111i\u1ec3m CVSS 9.3 v\u00e0 \u0111\u01b0\u1ee3c x\u1ebfp lo\u1ea1i nghi\u00eam tr\u1ecdng.<\/p>\n\n\n\n

    B\u1ea3n v\u00e1 v\u00e0 khuy\u1ebfn ngh\u1ecb x\u1eed l\u00fd<\/h2>\n\n\n\n

    Phi\u00ean b\u1ea3n v1.0.1<\/strong> c\u1ee7a cohere-terrarium \u0111\u00e3 \u0111\u01b0\u1ee3c ph\u00e1t h\u00e0nh nh\u01b0 b\u1ea3n v\u00e1 b\u1ea3o m\u1eadt cu\u1ed1i c\u00f9ng tr\u01b0\u1edbc khi d\u1ef1 \u00e1n ch\u00ednh th\u1ee9c ng\u1eebng ph\u00e1t tri\u1ec3n v\u00e0 \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef. Nh\u00e0 nghi\u00ean c\u1ee9u Jeremy Brown \u0111\u01b0\u1ee3c ghi nh\u1eadn l\u00e0 ng\u01b0\u1eddi ph\u00e1t hi\u1ec7n v\u00e0 b\u00e1o c\u00e1o l\u1ed7 h\u1ed5ng.<\/p>\n\n\n\n

    CERT\/CC khuy\u1ebfn ngh\u1ecb ng\u01b0\u1eddi d\u00f9ng v\u00e0 t\u1ed5 ch\u1ee9c \u0111ang tri\u1ec3n khai Terrarium th\u1ef1c hi\u1ec7n ngay:<\/p>\n\n\n\n

      \n
    • C\u1eadp nh\u1eadt l\u00ean phi\u00ean b\u1ea3n v1.0.1 ngay l\u1eadp t\u1ee9c.<\/li>\n
    • V\u00f4 hi\u1ec7u h\u00f3a c\u00e1c t\u00ednh n\u0103ng cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng g\u1eedi code v\u00e0o sandbox n\u1ebfu kh\u00f4ng c\u1ea7n thi\u1ebft.<\/li>\n
    • Ph\u00e2n \u0111o\u1ea1n m\u1ea1ng (network segmentation) \u0111\u1ec3 gi\u1edbi h\u1ea1n b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng v\u00e0 ng\u0103n ch\u1eb7n di chuy\u1ec3n ngang.<\/li>\n
    • Tri\u1ec3n khai Web Application Firewall \u0111\u1ec3 ph\u00e1t hi\u1ec7n v\u00e0 ch\u1eb7n l\u01b0u l\u01b0\u1ee3ng \u0111\u00e1ng ng\u1edd.<\/li>\n
    • Gi\u00e1m s\u00e1t ho\u1ea1t \u0111\u1ed9ng container \u0111\u1ec3 ph\u00e1t hi\u1ec7n s\u1edbm c\u00e1c d\u1ea5u hi\u1ec7u b\u1ea5t th\u01b0\u1eddng.<\/li>\n
    • H\u1ea1n ch\u1ebf quy\u1ec1n truy c\u1eadp v\u00e0o container v\u00e0 t\u00e0i nguy\u00ean c\u1ee7a n\u00f3 ch\u1ec9 d\u00e0nh cho nh\u00e2n s\u1ef1 \u0111\u01b0\u1ee3c \u1ee7y quy\u1ec1n.<\/li>\n<\/ul>\n\n\n\n

      C\u1ea3nh b\u00e1o r\u1ed9ng h\u01a1n: R\u1ee7i ro sandbox AI \u0111ang gia t\u0103ng<\/h2>\n\n\n\n

      V\u1ee5 vi\u1ec7c n\u00e0y x\u1ea3y ra trong b\u1ed1i c\u1ea3nh ng\u00e0y c\u00e0ng nhi\u1ec1u \u1ee9ng d\u1ee5ng AI tri\u1ec3n khai kh\u1ea3 n\u0103ng th\u1ef1c thi code t\u1ef1 \u0111\u1ed9ng, t\u1eeb c\u00e1c AI agent \u0111\u1ebfn code interpreter t\u00edch h\u1ee3p trong s\u1ea3n ph\u1ea9m. Khi LLM \u0111\u01b0\u1ee3c ph\u00e9p t\u1ea1o v\u00e0 ch\u1ea1y code, sandbox tr\u1edf th\u00e0nh l\u1edbp b\u1ea3o v\u1ec7 cu\u1ed1i c\u00f9ng. CVE-2026-5752 cho th\u1ea5y ngay c\u1ea3 c\u00e1c m\u00f4i tr\u01b0\u1eddng sandbox \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf chuy\u00ean bi\u1ec7t c\u0169ng c\u00f3 th\u1ec3 b\u1ecb v\u01b0\u1ee3t qua b\u1edfi c\u00e1c k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng c\u01a1 b\u1ea3n nh\u01b0 prototype chain traversal.<\/p>\n\n\n\n

      L\u1ed7 h\u1ed5ng n\u00e0y ti\u1ebfp n\u1ed1i xu h\u01b0\u1edbng \u0111\u00e1ng lo ng\u1ea1i g\u1ea7n \u0111\u00e2y v\u1ec1 b\u1ea3o m\u1eadt c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng AI, \u0111\u1eb7t ra c\u00e2u h\u1ecfi v\u1ec1 ti\u00eau chu\u1ea9n an to\u00e0n cho t\u1ea5t c\u1ea3 c\u00e1c n\u1ec1n t\u1ea3ng cho ph\u00e9p th\u1ef1c thi code do AI t\u1ea1o ra. Trong khi c\u1ed9ng \u0111\u1ed3ng \u0111ang th\u1ea3o lu\u1eadn v\u1ec1 r\u1ee7i ro c\u1ee7a AI t\u1ea1i t\u1ea7ng \u1ee9ng d\u1ee5ng, r\u1ee7i ro t\u1ea1i t\u1ea7ng th\u1ef1c thi code v\u1eabn ch\u01b0a nh\u1eadn \u0111\u01b0\u1ee3c s\u1ef1 ch\u00fa \u00fd x\u1ee9ng \u0111\u00e1ng.<\/p>\n\n\n\n

       <\/p>\n\n\n\n

      VNCyberS t\u1ed5ng h\u1ee3p t\u1eeb: The Hacker News, CERT\/CC, SentinelOne<\/em><\/p>","protected":false},"excerpt":{"rendered":"

      CVE-2026-5752 v\u1edbi \u0111i\u1ec3m CVSS 9.3 \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong Terrarium, sandbox Python m\u00e3 ngu\u1ed3n m\u1edf c\u1ee7a Cohere AI. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 tho\u00e1t kh\u1ecfi sandbox, th\u1ef1c thi l\u1ec7nh t\u00f9y \u00fd v\u1edbi quy\u1ec1n root trong container, th\u1eadm ch\u00ed ti\u1ebfp c\u1eadn m\u1ea1ng n\u1ed9i b\u1ed9 m\u00e0 kh\u00f4ng c\u1ea7n t\u01b0\u01a1ng t\u00e1c ng\u01b0\u1eddi d\u00f9ng.<\/p>","protected":false},"author":2,"featured_media":1096,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[78,102,35,34,103],"class_list":["post-1097","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-ai-bao-mat","tag-cohere-ai","tag-cve","tag-lo-hong-bao-mat","tag-sandbox"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1097","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1097"}],"version-history":[{"count":1,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1097\/revisions"}],"predecessor-version":[{"id":1098,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1097\/revisions\/1098"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1096"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1097"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1097"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1097"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}