En resumen
- CVE-2023-32313 es una vulnerabilidad MEDIO (CVSS 5.3) que afecta a vm2 (vm2 project), vm2.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.79%, mayor que el 56.3% de las vulnerabilidades.
- Solución: actualizar a 3.9.18 o posterior.
| Package | Affected versions | Patched versions |
|---|
| vm2 | < 3.9.18
| 3.9.18
|
| vm2 npm | < 3.9.18
| 3.9.18
|
Description
In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log.
Impact
A threat actor can edit options for console.log.
Patches
This vulnerability was patched in the release of version 3.9.18 of vm2.
Workarounds
After creating a vm make the inspect method readonly with vm.readonly(inspect).
References
PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
For more information
If you have any questions or comments about this advisory:
Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.
NVD description
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free