CVE-2023-37903
📋 TL;DR
CVE-2023-37903 is a critical sandbox escape vulnerability in vm2, a Node.js sandboxing library. Attackers with code execution inside the vm2 sandbox can exploit Node.js's custom inspect function to break out of the sandbox and execute arbitrary code on the host system. This affects all users running vm2 versions up to and including 3.9.19.
💻 Affected Systems
- vm2
📦 What is this software?
Vm2 by Vm2 Project
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution on the host system, allowing complete compromise of the server and potential lateral movement within the network.
Likely Case
Remote code execution leading to data theft, service disruption, or deployment of malware/ransomware.
If Mitigated
Limited impact if vm2 is isolated in a container with minimal privileges and network access, though sandbox escape still poses significant risk.
🎯 Exploit Status
Exploitation requires an initial code execution primitive within the vm2 sandbox. Once achieved, the sandbox escape is straightforward using the documented technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
Restart Required: No
Instructions:
No official patch exists. The vendor advises finding alternative software. Consider migrating to isolatedvm, isolated-vm, or other sandboxing solutions.
🧯 If You Can't Patch
- Immediately remove vm2 from production environments and replace with alternative sandboxing solutions.
- If vm2 must remain temporarily, isolate it in a container with minimal privileges, no network access, and strict resource limits.
🔍 How to Verify
Check if Vulnerable:
Check your package.json or node_modules for vm2 version. Run: npm list vm2 or check package-lock.json.Check Version:
node -e "console.log(require('vm2/package.json').version)" if vm2 is installedVerify Fix Applied:
Verify vm2 is no longer installed or has been replaced with an alternative. Run: npm list | grep vm2📡 Detection & Monitoring
Log Indicators:
- Unusual process spawns from Node.js applications using vm2
- Error logs related to sandbox violations or inspect function calls
Network Indicators:
- Unexpected outbound connections from Node.js processes that should be sandboxed
SIEM Query:
Process creation where parent process is Node.js and command line contains suspicious patterns like 'child_process.spawn' from vm2 context🔗 References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
- https://security.netapp.com/advisory/ntap-20230831-0007/
- https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
- https://security.netapp.com/advisory/ntap-20230831-0007/
- https://security.netapp.com/advisory/ntap-20241108-0002/
