Executive brief
vm2 is a Node.js sandbox used to safely execute untrusted code with restricted access to system modules. This vulnerability allows an attacker to break out of the sandbox and execute arbitrary code on the host system by manipulating the WeakMap prototype, leading to complete compromise of the sandbox environment and potential access to sensitive data or system resources.
Technical details
The vulnerability is a sandbox escape (CWE-94) in vm2 versions before 3.9.10 caused by unsafe prototype lookup for the WeakMap.prototype.set method. An attacker can override WeakMap.prototype.set from within the sandbox to gain access to host objects and internal call stacks. By manipulating Error.prepareStackTrace in combination with the prototype override, the attacker can extract references to the host process object and invoke arbitrary methods (e.g., process.exit). No authentication is required; the vulnerability is triggered when untrusted code runs within a VM instance. The fix involves using direct method references (e.g., via Reflect.apply or stored local references) instead of performing prototype lookups at runtime.
Affected products
- patriksimek vm2 <3.9.10
Timeline
- 2022-08-24: disclosed
- 2022-07-05: patched: Fix merged in PR #445
- 2022-12-21: advisory