Summary:
A team of researchers has recently patched a vulnerability, identified as CVE-2023-29017 which received the highest severity rating of 10.0. A popular JavaScript sandbox called VM2 that multiple software uses to run code securely in a virtualized environment has just been reported to have a critical vulnerability for which proof-of-concept exploit code has been made available. The library is made to allow Node.js servers to execute untrusted code in a controlled environment. It permits only a portion of the code to be executed while preventing unwanted access to system resources or outside data.[/subscribe_to_unlock_form]
Summary:
A team of researchers has recently patched a vulnerability, identified as CVE-2023-29017 which received the highest severity rating of 10.0. A popular JavaScript sandbox called VM2 that multiple software uses to run code securely in a virtualized environment has just been reported to have a critical vulnerability for which proof-of-concept exploit code has been made available. The library is made to allow Node.js servers to execute untrusted code in a controlled environment. It permits only a portion of the code to be executed while preventing unwanted access to system resources or outside data.[emaillocker id="1283"]
The researchers discovered that when an asynchronous error occurs, the host objects given to the "Error.prepareStackTrace" function by the VM2 library are handled incorrectly. By exploiting this vulnerability threat actors can bypass the sandbox's security measures and gain access to the host where the sandbox is running. Bypassing sandbox protections and obtaining remote code execution on the host are both possible outcomes of exploiting the security flaw.
Every version of VM2 before 3.9.14 is affected by the problem. A new version of the library, 3.9.15, was released to fix the issue.
Recommendations:
We strongly recommend you update your VM2 to version 3.9.15.
Update from here: https://github.com/patriksimek/vm2/releases/tag/3.9.15
References:
The following reports contain further technical details:
[/emaillocker]