Code injection in vm2 - CVE-2023-30547
Published: April 20, 2023 / Updated: December 18, 2023
Vulnerability identifier: #VU75367
CSH Severity: Medium
CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2023-30547
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to an error in exception sanitization. A remote user can raise an unsanitized host exception inside "handleException()", which can be used to escape the sandbox and run arbitrary code in host context.
Affected software
vm2
Multicluster Engine for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes
App Connect Enterprise Certified Container
Multicluster Engine for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes
App Connect Enterprise Certified Container
How to mitigate CVE-2023-30547
Install updates from vendor's website.
vm2 - update to 3.9.17
Multicluster Engine for Kubernetes - addressed in versions 2.0.7, 2.1.5, 2.2.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.7, 2.6.4, 2.7.3
App Connect Enterprise Certified Container - addressed in versions 5.0.7, 8.1.0
Multicluster Engine for Kubernetes - addressed in versions 2.0.7, 2.1.5, 2.2.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.5.7, 2.6.4, 2.7.3
App Connect Enterprise Certified Container - addressed in versions 5.0.7, 8.1.0
Links to Public Exploits and PoC-codes
External References
- https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
- https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
- https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
- https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
Related Security Bulletins
- Sandbox escape in vm2 for Notde.js
- Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
- Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
- Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.0
- Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
- Red Hat Advanced Cluster Management for Kubernetes 2.5 update for vm2
- Red Hat Advanced Cluster Management for Kubernetes 2.6 update for vm2
- Code injection in IBM App Connect Enterprise Certified Container