CVE-2023-32314: vm2 Sandbox Escape Vulnerability Leads to Remote Code Execution

A critical vulnerability, CVE-2023-32314, exists in the vm2 sandbox, which is commonly used in Node.js applications to run untrusted code in a secure environment. The vulnerability can lead to a sandbox escape, enabling an attacker to gain remote code execution rights on the host running the vulnerable sandbox. This long read post will explore the details of the vulnerability, including its code snippet, original references, and exploit details. If you are a user of vm2 up to and including version 3.9.17, it is essential that you upgrade to the patched version, 3.9.18, as there are no known workarounds for this vulnerability.

Background

The vm2 sandbox is widely used in the Node.js ecosystem to execute untrusted code with built-in Node.js modules. It is designed to provide isolation between the executing code and the host system. However, a vulnerability in the management of proxies within the vm2 sandbox can allow a malicious user to escape the sandbox's protections, leading to potential remote code execution on the host running the sandbox.

Exploit Details

The vulnerability lies in the unexpected creation of a host object based on the specification of Proxy. When a malicious user defines a proxy and triggers specific methods in their untrusted code, the vm2 sandbox fails to enforce proper isolation, allowing the attacker to gain unauthorized access to the host system.

Here's a simplified code snippet showcasing the vulnerability

const vm2 = require("vm2");
const untrustedCode = `
  const proxyHandler = {
    get: (target, prop) => {
      if (prop === 'foo') {
        return target.sandboxEscape();
      }
    }
  };

  const maliciousProxy = new Proxy({}, proxyHandler);
  maliciousProxy.foo;
`;

const sandbox = new vm2.NodeVM();
sandbox.run(untrustedCode);

In this example, the attacker creates a Proxy object (maliciousProxy) with a custom get() function in its handler. When the foo property is accessed on this proxy, the attacker's custom get() function is triggered, which then calls the sandboxEscape() function. This function would typically be unavailable to the untrusted code, but the misuse of the Proxy feature allows the attacker to call it, exploiting the vulnerability in vm2.

Links to Original References

For more in-depth information regarding CVE-2023-32314, its discovery, and the process through which it was patched, please refer to the following resources:

- GitHub Security Advisory: An official security advisory on the vm2 GitHub repository detailing the vulnerability and its resolution.
- NPM Advisory: An advisory hosted on the NPM (Node.js Package Manager) website that briefly describes the vulnerability and provides information on how to update the affected package.
- CVE Details: A comprehensive overview of the CVE-2023-32314 vulnerability hosted by the MITRE Corporation, the organization responsible for maintaining the Common Vulnerabilities and Exposures (CVE) system.

Remediation

The vulnerability has been patched in version 3.9.18 of the vm2 package. Users are strongly advised to update their installations as soon as possible to mitigate the associated risks. There are no known workarounds for this vulnerability, so upgrading to the latest, patched version of vm2 is the only way to ensure protection from this exploit.

Conclusion

CVE-2023-32314 represents a severe security risk for users of the vm2 package. The vulnerability allows an attacker to execute remote code within the host system by exploiting the vm2 sandbox's proxy handling mechanism. To secure your applications and systems, it is crucial to upgrade to the patched version 3.9.18 of the vm2 package immediately. By addressing this vulnerability, you can ensure that the vm2 sandbox functions as intended and continues to provide a secure environment to run untrusted code in your Node.js applications.

Timeline

Published on: 05/15/2023 20:15:00 UTC
Last modified on: 05/24/2023 20:50:00 UTC