Executive brief
vm2 is a JavaScript sandbox environment used to safely run untrusted code in isolation. A flaw in how it handles asynchronous errors allows an attacker to escape the sandbox and execute arbitrary code on the host system with full system privileges. This could lead to complete compromise of any application relying on vm2 to isolate untrusted scripts.
Technical details
vm2 failed to properly sanitize host objects passed to the Error.prepareStackTrace callback during handling of unhandled asynchronous errors. An attacker can craft malicious code that triggers an unhandled async error, allowing the Error.prepareStackTrace handler to receive and manipulate host objects, thereby breaking out of the sandbox. The vulnerability affects all versions up to 3.9.14 and requires only network access with no authentication or user interaction. Successful exploitation grants arbitrary code execution on the host system with the privileges of the Node.js process. The vulnerability was patched in version 3.9.15.
Affected products
- patriksimek vm2 <=3.9.14
Timeline
- 2023-04-06: disclosed
- 2023-04-07: patched: Version 3.9.15 released