Executive brief
vm2 is a popular JavaScript sandbox library used to safely execute untrusted code in an isolated environment. A flaw in how vm2 handles Node.js custom inspect functions allows attackers with code execution inside the sandbox to break out and run arbitrary commands on the host system. This undermines the core security guarantee of the sandbox, potentially allowing complete system compromise.
Technical details
This is a sandbox escape vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) in vm2 versions through 3.9.19. The vulnerability stems from improper handling of Node.js custom inspect functions, which allows an attacker with code execution primitives inside the vm2 sandbox context to escape the sandbox boundary and execute arbitrary code on the host. The attack vector is network-reachable with no authentication or user interaction required. While a proof-of-concept exists, the vulnerability requires the attacker to already have some code execution capability within the sandbox itself (not an unauthenticated remote code execution against the host). Patching is available in version 3.10.3.
Affected products
- vm2 vm2 <=3.9.19
Timeline
- 2023-07-13: disclosed
- 2023-09-05: other: PoC disclosure date
- 2023-07-12: patched: Version 3.10.3 available