vm2 Sandbox Escape vulnerability

[TheKingTermux]

Description

• Overview
  There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.

• Impact
  A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

• Patches
  This vulnerability was patched in the release of version 3.9.16 of vm2.

• Workarounds
  None.

• References
  Github Issue - Sandbox Escape in vm2@3.9.15 patriksimek/vm2#516
  PoC - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c

• For more information
  If you have any questions or comments about this advisory:

• Open an issue in VM2
  Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.

Severity Check

• Low
• Moderate
• High
• Critical

Severity Number

9,8 / 10

CVSS base metrics

• Attack vector
  Network

• Attack complexity
  Low

• Privileges required
  None

• User interaction
  None

• Scope
  Unchanged

• Confidentiality
  High

• Integrity
  High

• Availability
  High

• CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Weaknesses
  CWE-913

• CVE ID
  CVE-2023-29199

• GHSA ID
  GHSA-xj72-wvfv-8985

• Source code
  patriksimek/vm2

Information

• Package
  vm2 (npm)

• Affected versions
  < 3.9.16

• Patched versions
  3.9.16

References

• GHSA-xj72-wvfv-8985

• Sandbox Escape in vm2@3.9.15 patriksimek/vm2#516

• patriksimek/vm2@24c724d

• https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c

• https://github.com/patriksimek/vm2/releases/tag/3.9.16

• https://nvd.nist.gov/vuln/detail/CVE-2023-29199