REDHAT-BUG-2477205: High severity vm2 vulnerability
vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using vm2 versions 3.9.6 through 3.10.5 are affected when they execute attacker-controlled JavaScript in a default VM or inherited NodeVM. The issue can modify shared host-realm Object.prototype, Array.prototype, and Function.prototype.
What does an attacker need to exploit it?
An attacker needs the ability to run JavaScript inside the affected vm2 sandbox. The description states that this can occur in a default VM or inherited NodeVM configuration.
Is a non-default configuration required for exploitation?
No. The issue affects attacker-controlled JavaScript running in a default VM, as well as an inherited NodeVM.
What version fixes the vulnerability?
vm2 version 3.11.0 fixes this vulnerability. Versions from 3.9.6 through 3.10.5 are identified as affected.