vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.
In the lib/setup-sandbox.js file, sanitization of callbacks is applied only to `localPromise.prototype.then` and `localPromise.prototype.catch`, while the equivalents on the `globalPromise` object remain unprotected. Since asynchronous functions (async) return a `globalPromise` object, an attacker can pass an unsanitized callback through the Promise mechanism, bypassing sandbox protection. This enables execution of arbitrary JavaScript code outside the isolated vm2 context.
An attacker can completely escape from the vm2 sandbox and execute arbitrary code in the context of the host Node.js process, potentially leading to full server compromise, data theft, and violation of system integrity and availability.
Update the vm2 library to version 3.10.2, which fixes the described vulnerability. The patch is available in the official GitHub repository of the project (tag v3.10.2).
vm2 (Vm2 Project) in all versions before 3.10.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HVm2 Project Vm2
APPVm2 Project< 3.10.2
Related vulnerabilities
vm2: mutacja prototypów hosta z poziomu sandbox (prototype pollution)
vm2 (Node.js): ucieczka z sandbox przez BaseHandler.getPrototypeOf (RCE)
Ucieczka z sandboxa w bibliotece vm2 dla Node.js (RCE)
vm2: ominięcie listy dozwolonych modułów i RCE przez builtin 'module'
vm2 (Node.js): ucieczka z sandbox przez zagnieżdżony NodeVM (RCE)