CVE-2022-36067 - OpenCVE

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Vm2 Project	Vm2

Configuration 1 [-]

cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*

References

Link	Resource
https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71	Exploit Third Party Advisory
https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164	Patch Third Party Advisory
https://github.com/patriksimek/vm2/issues/467	Issue Tracking Third Party Advisory
https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq	Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20221017-0002/	Third Party Advisory
https://www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-09-06T00:00:00

Updated: 2022-10-17T00:00:00

Reserved: 2022-07-15T00:00:00

Link: CVE-2022-36067

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-09-06T22:15:09.207

Modified: 2022-11-08T03:03:23.473

Link: CVE-2022-36067

JSON object: View

Redhat Information

No data.

CWE

CWE-913

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "3CB151FD-32BF-4CED-93D3-F07D6F62E4DC", "versionEndExcluding": "3.9.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds."}, {"lang": "es", "value": "vm2 es un sandbox que puede ejecutar c\u00f3digo no confiable con los m\u00f3dulos incorporados de Node en la lista blanca. En versiones anteriores a 3.9.11, un actor de la amenaza puede omitir las protecciones del sandbox para conseguir derechos de ejecuci\u00f3n de c\u00f3digo remoto en el host que ejecuta el sandbox. Esta vulnerabilidad fue parcheada en el lanzamiento de la versi\u00f3n 3.9.11 de vm2. No se presentan mitigaciones conocidas.\n"}], "id": "CVE-2022-36067", "lastModified": "2022-11-08T03:03:23.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-09-06T22:15:09.207", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/patriksimek/vm2/issues/467"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221017-0002/"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-913"}], "source": "security-advisories@github.com", "type": "Secondary"}]}