Junglewise Threat Intelligence

CVE-2022-36067: vm2 sandbox escape to remote code execution

CVE-2022-36067 · Severity: low · CVSS 3.1 · Published 2022-09-28

Technologies: Vm2. Vendors: npm.

Executive brief

vm2 is a popular Node.js library that provides a secure sandbox for executing untrusted JavaScript code. A critical sandbox bypass vulnerability allows attackers to escape the sandbox and execute arbitrary code on the host system running vm2, potentially compromising the entire application and server.

Technical details

vm2 contains a sandbox escape vulnerability (CWE-913: Improper Control of Dynamically-Managed Code Resources) in its core sandbox setup mechanism. The vulnerability allows an attacker to bypass sandboxing protections and execute remote code on the host running the vm2 process. The attack requires network access to the application using vm2, with no authentication or user interaction required. An attacker can exploit this to gain complete control over the host system. The vulnerability was patched in vm2 version 3.9.11; all prior versions are vulnerable.

Affected products

  • vm2 before 3.9.11

Timeline

  • 2022-08-30: disclosed
  • 2022-09-28: advisory
  • 2022-09-28: patched: Version 3.9.11

References

Related threats