Vulnerability · Published Dec 22, 2023 · Assigned by GitHub_M
CVE-2023-51661Filesystem sandbox not enforced in wasmer-cli
High 8.4
In plain English
A high-severity improper access control in wasmer from wasmerio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.6%top 51.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j x_refsource_CONFIRM
- https://github.com/wasmerio/wasmer/issues/4267 x_refsource_MISC
- https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3c x_refsource_MISC