Quick answers
- Is CVE-2023-37903 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-37903 being exploited in the wild.
- How severe is CVE-2023-37903?
- Low severity, with a CVSS score of 3.1, published 13 July 2023.
- Which products and versions are affected?
- vm2 (npm) SEMVER:introduced=0,last_affected=3.9.19.
- Is there a fix for CVE-2023-37903?
- A patch was published on 2023-07-12: Version 3.10.3 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-37903 attacked?
- It is attacked over the network.
- Am I affected by CVE-2023-37903?
- Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a sandbox escape vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) in vm2 versions through 3.9.19. The vulnerability stems from improper handling of Node.js custom inspect functions, which allows an attacker with code execution primitives inside the vm2 sandbox context to escape the sandbox boundary and execute arbitrary code on the host. The attack vector is network-reachable with no authentication or user interaction required. While a proof-of-concept exists, the vulnerability requires the attacker to already have some code execution capability within the sandbox itself (not an unauthenticated remote code execution against the host). Patching is available in version 3.10.3.
Affected products
- vm2 vm2 <=3.9.19
Identifiers
- CVE-2023-37903
- GHSA-g644-9gfx-q4q4
Timeline
- 2023-07-13: disclosed
- 2023-09-05: other: PoC disclosure date
- 2023-07-12: patched: Version 3.10.3 available