Improper Control of Dynamically-Managed Code Resources in vm2 - CVE-2023-29017

Vulnerability identifier: #VU74606

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-29017

CWE-ID: CWE-913

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to escape sandbox restrictions.

The vulnerability exists due to improper handling of host objects passed to "Error.prepareStackTrace" in case of unhandled async errors. A remote attacker can pass specially crafted input to the application, escape sandbox restrictions and execute arbitrary code on the host.

vm2
backstage/techdocs-common
API Gateway
API Manager
Multicluster Engine for Kubernetes
IBM Cloud Pak for Multicloud Management
Red Hat Advanced Cluster Management for Kubernetes
App Connect Enterprise Certified Container
IBM Cloud Pak for Watson AIOps

Install updates from vendor's website.

vm2 - update to 3.9.15
API Gateway - update to May 2023
API Manager - update to May 2023
backstage/techdocs-common - update to 1.13.0
Multicluster Engine for Kubernetes - addressed in versions 2.0.7, 2.1.5, 2.2.3
IBM Cloud Pak for Multicloud Management - update to 2.3.8
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.7, 2.6.4, 2.7.3
IBM Cloud Pak for Watson AIOps - update to 3.7.1
App Connect Enterprise Certified Container - addressed in versions 5.0.6, 8.1.0

• Exploit #8968 - vm2_3.9.14_exploit_1.js (April 10, 2023)

• https://github.com/patriksimek/vm2/issues/515
• https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50
• https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d
• https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv

• Sandbox escape in vm2 for Notde.js
• backstage update for vm2
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.0
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
• Red Hat Advanced Cluster Management for Kubernetes 2.5 update for vm2
• Red Hat Advanced Cluster Management for Kubernetes 2.6 update for vm2
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• App Connect Enterprise Certified Container update for vm2
• Multiple vulnerabilities in Axway API Gateway and API Manager
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management