CVE-2023-30547
📋 TL;DR
This vulnerability in vm2 sandbox allows attackers to escape the sandbox environment and execute arbitrary code on the host system by exploiting improper exception sanitization. It affects all applications using vm2 versions up to 3.9.16 to run untrusted JavaScript code. The impact is severe as it enables full host system compromise.
💻 Affected Systems
- vm2
📦 What is this software?
Vm2 by Vm2 Project
⚠️ Risk & Real-World Impact
Worst Case
Complete host system takeover with attacker gaining full control over the server, allowing data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution on the host system, enabling data exfiltration, cryptocurrency mining, or participation in botnets.
If Mitigated
Limited impact if vm2 is only used for isolated, non-critical operations with minimal host permissions.
🎯 Exploit Status
Proof-of-concept code is publicly available in GitHub gists and security advisories, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.17
Vendor Advisory: https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
Restart Required: Yes
Instructions:
1. Update vm2 dependency to version 3.9.17 or higher. 2. Run 'npm update vm2' or 'yarn upgrade vm2'. 3. Restart all Node.js applications using vm2. 4. Test that sandbox functionality still works as expected.
🧯 If You Can't Patch
- Isolate affected systems from network access and sensitive data
- Replace vm2 usage with alternative sandbox solutions or remove untrusted code execution entirely
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list vm2' to see installed version. If version is 3.9.16 or lower, system is vulnerable.Check Version:
npm list vm2 | grep vm2Verify Fix Applied:
After updating, run 'npm list vm2' to confirm version 3.9.17 or higher is installed. Test sandbox functionality with known safe scripts.📡 Detection & Monitoring
Log Indicators:
- Unusual process spawns from Node.js applications
- Unexpected file system access patterns
- Sandbox exception errors in application logs
Network Indicators:
- Outbound connections to suspicious IPs from Node.js processes
- Unusual data exfiltration patterns
SIEM Query:
process_name:node.exe AND (process_command_line:*vm2* OR parent_process_name:node.exe) AND (event_type:process_create OR event_type:network_connection)🔗 References
- https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
- https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
- https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
- https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
- https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
- https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
- https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
- https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
