Vulnerability · Published May 15, 2023 · Assigned by GitHub_M
CVE-2023-32314Sandbox Escape
Critical 9.8
In plain English
A critical-severity injection in vm2 from patriksimek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 8.1% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | vm2 | 3.9.18 | GHSA-whpj-8f3w-67p5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| patriksimek | vm2 | < 3.9.18 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5 x_refsource_CONFIRM
- https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf x_refsource_MISC
- https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac x_refsource_MISC
- https://github.com/patriksimek/vm2/releases/tag/3.9.18 x_refsource_MISC