CVE-2023-37466

Published Jul 14, 2023

Last updated 4 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2023-37466 is a sandbox escape vulnerability found in the `vm2` library, an advanced virtual machine and sandbox for Node.js, affecting versions up to 3.9.19. This flaw allows attackers to bypass Promise handler sanitization by exploiting the `@@species` accessor property. By leveraging this vulnerability, an attacker can escape the `vm2` sandbox environment and execute arbitrary code on the host system. Due to critical security issues like this, maintenance of the `vm2` project has been discontinued, and its use in production environments is not recommended.

Description: vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.
Source: security-advisories@github.com
NVD status: Modified
Products: vm2

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-94
nvd@nist.gov: CWE-94

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 4

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "5F54A6F9-FD6B-4E23-A6B7-616952129C1C",
            "versionEndIncluding": "3.9.19",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.