by Kastro
Paper/Archive/CVE-2023-30547

CVE-2023-30547

patriksimek vm2 — Sandbox Escape in vm2

EPSS 73%public exploitCVSS 10.0
critical.is priorityof 100
60
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 99.5.995 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Affected

ProductAffectedFixed inSource
vm2< 3.9.17–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2mrefgithub.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049refgithub.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5refgist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244