CVE-2023-37466: vm2 Sandbox Escape vulnerability
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.
Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
Patches None.
Workarounds None.
References PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
For more information
If you have any questions or comments about this advisory:
- Open an issue in VM2
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
Other sources
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.
— Red Hat
Node.js vm2 module could allow a remote attacker to execute arbitrary code on the system, caused by a sandbox escape flaw in the Promise handler. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with @@species accessor property allowing attackers to escape the sandbox and run arbitrary code. Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.10.0 - Compensating control
Do not use vm2 for production, since the library “contains critical security issues and should not be used for production.”
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37466?
CVE-2023-37466 has a critical severity level due to the potential for remote code execution.
How do I fix CVE-2023-37466?
To fix CVE-2023-37466, you should upgrade vm2 to version 3.9.20 or later.
What systems are affected by CVE-2023-37466?
CVE-2023-37466 affects vm2 versions up to and including 3.9.19 used in various Node.js applications.
Can CVE-2023-37466 lead to data breaches?
Yes, CVE-2023-37466 can potentially lead to data breaches as it allows attackers to execute arbitrary code in the system's context.
Who is responsible for addressing the CVE-2023-37466 vulnerability?
The responsibility lies with the developers or administrators of applications using the affected versions of vm2.