GHSA-22rr-f3p8-5gf8
First published: Fri Sep 15 2023(Updated: )
### Impact In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox running code in the main nodejs context. ### Patches Patched in v10.6.0 by replacing `vm2` with `isolated-vm` ### Workarounds None ### References https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/directus | <10.6.0 | 10.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/directus/directus/security/advisories/GHSA-22rr-f3p8-5gf8
- https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
- https://github.com/directus/directus/pull/19332
- https://github.com/directus/directus/commit/284156426fa94f688e8d65a7a4f34f9e6705f058
- https://github.com/advisories/GHSA-22rr-f3p8-5gf8 (Advisory)
Frequently Asked Questions
What is the impact of GHSA-22rr-f3p8-5gf8?
The impact is that in vm2 versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code in the main Node.js context in Directus.
How can an attacker exploit GHSA-22rr-f3p8-5gf8?
Attackers can exploit GHSA-22rr-f3p8-5gf8 by leveraging the bypassed Promise handler sanitization in vm2 to escape the sandbox and execute arbitrary code.
How does GHSA-22rr-f3p8-5gf8 affect Directus?
In Directus, GHSA-22rr-f3p8-5gf8 specifically impacts the "Run Script" operation in flows, allowing the execution of code in the main Node.js context.
What is the severity of GHSA-22rr-f3p8-5gf8?
The severity of GHSA-22rr-f3p8-5gf8 is high with a CVSS score of 7.6.
How can I fix GHSA-22rr-f3p8-5gf8?
To fix GHSA-22rr-f3p8-5gf8, update vm2 to version 3.9.20 or higher in Directus.
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- collector/github-advisory
- alias/GHSA-22rr-f3p8-5gf8
- collector/github-advisory-latest
- package-manager/npm