GitHub Advisoryadvisory · npm
GHSA-cchq-frgv-rjh5 vm2 Sandbox Escape vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2023-37466
- Ecosystem
- npm
- Packages
- vm2
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
- Reviewed
- 2023-07-13
Affected packages
• npm vm2: < 3.10.0 → fixed in 3.10.0
Description
In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.
Impact
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
Patches
None.
Workarounds
None.
References
PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
For more information
If you have any questions or comments about this advisory:
• Open an issue in VM2
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
Related
Alias · CVE (1)
- CVE-2023-37466 vm2 is an advanced vm/sandbox for Node.js. vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-37466 advisory
- https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744 web
- https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9 web
- https://github.com/patriksimek/vm2 package
- https://github.com/patriksimek/vm2/releases/tag/v3.10.0 web
- https://security.netapp.com/advisory/ntap-20230831-0007 web
- https://security.netapp.com/advisory/ntap-20241108-0002 web