Executive brief
jsreport is a reporting platform that dynamically generates documents and reports. Versions before 3.11.3 embed a vulnerable version of vm2 (a JavaScript sandboxing library), allowing attackers to escape the sandbox and execute arbitrary code. An attacker could exploit this to take over a jsreport server or trick users into running malicious reports, leading to complete compromise of the reporting system and potential data theft.
Technical details
This vulnerability exploits CVE-2023-29017 in vm2, a code injection flaw in the sandboxing mechanism. jsreport prior to version 3.11.3 had a hardcoded vulnerable version of vm2 in the jsreport-core package.json. The attack is network-accessible (no authentication required) and can be triggered via maliciously crafted JavaScript code embedded in reports or webpages. An attacker can escape the vm2 sandbox to execute arbitrary code with the privileges of the jsreport process. The fix is available in jsreport 3.11.3 and later, which updates to a patched version of vm2.
Affected products
- jsreport jsreport before 3.11.3
Timeline
- 2023-05-08: disclosed
- 2023-04-21: patched: Fix released in version 3.11.3