CVE-2023-30547: Sandbox Escape in vm2
A flaw was found in the vm2 sandbox. When exception handling is triggered, an unsanitized host is not managed properly. This issue may allow an attacker to bypass the sandbox protections, which can lead to remote code execution on the hypervisor host or the host that is running the sandbox.
Other sources
There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException() which can be used to escape the sandbox and run arbitrary code in host context.
Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.
Patches This vulnerability was patched in the release of version 3.9.17 of vm2.
Workarounds None.
References PoC - https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
For more information
If you have any questions or comments about this advisory:
- Open an issue in VM2
Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException() which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version 3.9.17 of vm2. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-30547?
CVE-2023-30547 is classified as a critical security vulnerability due to the potential for remote code execution.
How do I fix CVE-2023-30547?
To fix CVE-2023-30547, update the vm2 package to version 3.9.17 or later.
Who is affected by CVE-2023-30547?
Users of the vm2 package prior to version 3.9.17 on Node.js are affected by CVE-2023-30547.
What type of vulnerability is CVE-2023-30547?
CVE-2023-30547 is a security vulnerability that involves improper handling of unsanitized hosts, allowing sandbox bypass.
What can happen if CVE-2023-30547 is exploited?
Exploitation of CVE-2023-30547 may lead to remote code execution on the hypervisor host or the host running the affected application.