Incorrect cipher key & IV length processing

In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.

Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.

Patches None.

Workarounds None.

References PoC is to be disclosed on or after the 5th of September.

Similarity with CVE-2023-37466 While this advisory might look similar to CVE-2023-37466, it is a completely different way of escaping the sandbox.

For more information If you have any questions or comments about this advisory:

- Open an issue in VM2

Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.

In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.

Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.

Patches None.

Workarounds None.

References PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9

For more information

If you have any questions or comments about this advisory:

- Open an issue in VM2

Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.

A flaw was found in npm package ansiup versions < 5.0.0 when parsing untrusted user input. An attacker could take advantage of this by introducing ANSI escape codes to inject arbitrary HTML and JavaScript in result mounting a cross-site scripting (XSS) attack.

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4756 to the following vulnerability:

Name: CVE-2010-4756 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4756 Assigned: 20110302 Reference: http://securityreason.com/achievementsecurityalert/89 Reference: http://cxib.net/stuff/glob-0day.c Reference: http://securityreason.com/exploitalert/9223

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

Node.js could allow a remote attacker to bypass security restrictions, caused by a path traversal bypass using non-Buffer Uint8Array objects. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the experimental permission model.

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cross site scripting (XSS). A remote attacker could execute malicious commands due to improper validation of column headings in Cognos Assistant. IBM X-Force ID: 282780.

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certificate validation when using the IBM Planning Analytics Data Source Connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between IBM Planning Analytics server and IBM Cognos Analytics server. IBM X-Force ID: 283364.

Apache Shiro could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability when "form" authentication is used. An attacker could exploit this vulnerability using a specially crafted URL to redirect a victim to arbitrary Web sites.

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

References: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

Node.js could allow a remote attacker to bypass security restrictions, caused by the circumvention of integrity checks by the policy feature. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the experimental permission model.

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems.

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.

Google Android could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the Android runtime library. By using a specially-crafted payload, an attacker could exploit this vulnerability to execute arbitrary code in the context of an unprivileged process.

Clojure could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially crafted serialized object, an attacker could exploit this vulnerability to execute arbitrary code on the system.