| Package | Affected versions | Patched versions |
|---|---|---|
| vm2 | < 3.11.7 | 3.11.7 |
Sandboxed code is able to disclose host memory used by small allocations by Buffer.from, Buffer.concat.
vm2 exposes Buffer object to sandboxed code by default. Small Buffer allocations (for example, Buffer.allocUnsafe(), Buffer.from(array), Buffer.from(string), and Buffer.concat()) use the same Buffer pool, which is shared with the sandbox. This allows sandboxed code to disclose host memory used by the functions listed above.
Tested against [email protected] in the node REPL.
Buffer.from('host-memory-should-not-leak-to-sandbox')
new (require('vm2').VM)().run(`Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString('ascii')`)
Since sandbox acquires an ArrayBuffer that is used by the host, it can disclose sensitive data going through functions mentioned above and even write to these buffers, which can lead to sensitive data exposure and potentially denial-of-service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free