Описание
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.
A flaw was found in vm2 (before 3.11.0), a Node.js sandbox library. Sandboxed code can obtain the host Object (e.g. via HostObject.getOwnPropertySymbols and Symbol(nodejs.util.inspect.custom)), bypassing isolation and enabling arbitrary code execution on the host.
Отчет
vm2 is vulnerable to sandbox escape via host Object leakage in the VM bridge. A remote unauthenticated attacker who can submit code to a vm2 sandbox may obtain host-realm objects and execute arbitrary code on the host process. Fixed in vm2 3.11.0.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Not affected | ||
| Self-service automation portal 2 | ansible-automation-platform/automation-portal | Affected |
Показывать по
Дополнительная информация
Статус:
10 Critical
CVSS3
Связанные уязвимости
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0.
Уязвимость библиотеки vm2 пакетного менеджера NPM, связанная с неверным управлением генерацией кода, позволяющая нарушителю обойти защитный механизм песочницы и выполнить произвольный код
10 Critical
CVSS3