Patchfirst
Patchfirst
CVE-2023-30547 Public exploit Critical · 9.8 EPSS 73.0%

Sandbox Escape in vm2

patriksimek · vm2

Summary

The vm2 sandbox library (patriksimek's vm2, versions up to 3.9.16) contains a flaw in its exception sanitization inside handleException(), which lets untrusted sandboxed code raise an unsanitized host exception. An attacker who can get untrusted code to run inside the sandbox, with no authentication or user interaction needed, can use this to escape the sandbox and execute arbitrary code in the host context.

Official description · CVE.org

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Breakdown
31.8 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 8 months after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+8 mo

See the family tree

9 related vulnerabilities in the same code over 14 months. The latest fix listed for vm2 is 3.10.0.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2021-23555Sandbox Bypass11 Feb 2022
  2. relatedMedium

    Why these are linked:

    CVE-2023-29199vm2 Sandbox escape14 Apr 2023
  3. relatedHigh

    Why these are linked:

    This CVECVE-2023-30547Sandbox Escape in vm217 Apr 2023

6 more CVEs are in this family. See the family tree

Fixes in vm2npm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 3.9.11CVE-2022-360676 Sep 2022
  2. 3.9.15CVE-2023-290176 Apr 2023
  3. 3.9.16CVE-2023-2919914 Apr 2023
  4. 3.9.17CVE-2023-3054717 Apr 2023
  5. 3.9.18CVE-2023-3231315 May 2023
  6. 3.9.18CVE-2023-3231415 May 2023
  7. 3.10.0CVE-2023-3746613 Jul 2023Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: vm2.

npmvm2GHSA-ch3r-j5x3-6q2m

Upgrade to 3.9.17 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-29017).

npmnpm install vm2@3.9.17

The first fix for CVE-2023-30547.

Affected versions

If you runUpgrade to
All versions before 3.9.173.9.17

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m

x_refsource_MISC 3

github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
↑ ↓ chooseEnter openEsc close