Executive brief
isolated-vm is a Node.js library that creates secure V8 isolates to sandbox untrusted code. Misuse of its Reference and NativeModule APIs can allow attackers to escape the sandbox and access the main Node.js process's capabilities, including execution of arbitrary native code if combined with file upload functionality. This breaks the intended security isolation and puts any application relying on isolated-vm for sandboxing at risk of complete compromise.
Technical details
The vulnerability exists in isolated-vm versions before 4.0.0 and stems from insufficient isolation enforcement in transferable APIs. Reference objects expose the full prototype chain of referenced objects, enabling attackers to traverse up to the Node.js Function object if a Reference is exposed to untrusted code. Similarly, the NativeModule API can be invoked to load and execute arbitrary native code from the filesystem. The attack vector requires that an implementer inadvertently exposes a Reference or NativeModule object to attacker-controlled code within an isolate. In v4.0.0, mitigations include disabling prototype chain traversal on Reference instances, making all isolated-vm API prototypes immutable, restricting NativeModule instantiation to Node.js isolates, and improved security documentation. No indication of active exploitation in the wild as of the advisory date.
Affected products
- laverdet isolated-vm before 4.0.0
Timeline
- 2021-03-30: disclosed: Reported to GitHub advisory database
- 2021-04-06: patched: Fix released in v4.0.0
- 2021-04-06: advisory: CVE-2021-21413 published