Summary:
Another sandbox escape proof of concept (PoC) attack that enables the execution of unsafe code on a host running the VM2 sandbox has been published by a security researcher. A wide range of software tools employs VM2, a specialized JavaScript sandbox, to run and test untrusted code in an isolated environment without allowing it access to host system resources or external data.[/subscribe_to_unlock_form]
Summary:
Another sandbox escape proof of concept (PoC) attack that enables the execution of unsafe code on a host running the VM2 sandbox has been published by a security researcher. A wide range of software tools employs VM2, a specialized JavaScript sandbox, to run and test untrusted code in an isolated environment without allowing it access to host system resources or external data.[emaillocker id="1283"]
The library is frequently used in code editors, security tools, integrated development environments (IDEs), and various pen-testing frameworks. The number of downloads from the NPM package repository each month is in the millions. Over the past two weeks, multiple important sandbox escapes were discovered and disclosed in VM2, allowing attackers to run malicious code outside of the boundaries of the sandboxed environment. Researchers found the first sandbox escape vulnerability, tracked as CVE-2023-29017.
The most recent flaw is identified as CVE-2023-30547. (CVSS score: 9.8 - critical) and is a flaw in the way handleException sanitizes host exceptions, allowing an attacker to raise an invalid host exception. This procedure sanitizes exceptions that are encountered in the sandbox to stop the host's identity from leaking. However, the "handleException" function won't be able to sanitize a customized getPrototypeOf proxy handler that an attacker configures and throws an invalid host exception. This enables the attacker to "access the host Function," or to overcome the sandbox's limitations and execute arbitrary code in the host context, opening the way to potentially serious attacks.
Recommendations:
We strongly recommend that you upgrade VM2 Library to version 3.9.17
References:
The following reports contain further technical details:
[/emaillocker]