A now-patched security flaw in the vm2 JavaScript sandbox module could be abused by a remote adversary to break out of security barriers and perform arbitrary operations on the underlying machine.
“A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox,” GitHub said in an advisory published on September 28, 2022.
The issue, tracked as CVE-2022-36067 and codenamed Sandbreak, carries a maximum severity rating of 10 on the CVSS vulnerability scoring system. It has been addressed in version 3.9.11 released on August 28, 2022.
vm2 is a popular Node library that’s used to run untrusted code with allowlisted built-in modules. It’s also one of the most widely downloaded software, accounting for nearly 3.5 million downloads per week.
The shortcoming is rooted in the error mechanism in Node.js to escape the sandbox, according to application security firm Oxeye, which discovered the flaw.
This means that successful exploitation of CVE-2022-36067 could permit an attacker to bypass the vm2 sandbox environment and run shell commands on the system hosting the sandbox.
In light of the critical nature of the vulnerability, users are recommended to update to the latest version as soon as possible to mitigate possible threats.
“Sandboxes serve different purposes in modern applications, such as examining attached files in email servers, providing an additional security layer in web browsers, or isolating actively running applications in certain operating systems,” Oxeye said.
“Given the nature of the use cases for sandboxes, it’s clear that the vm2 vulnerability can have dire consequences for applications that use vm2 without patching.”