Executive Summary

The vulnerability in vm2 involves the BaseHandler.set trap in bridge.js ignoring the receiver parameter as specified by the ECMA-262 Proxy set trap specification. Instead of creating an own property on the receiver when it differs from the proxy, the implementation always writes directly to the host target object.

This flaw allows sandboxed code to write properties to host objects through inherited proxies or forged receivers, effectively turning exposed host objects into write channels. Attackers can exploit this to inject dangerous cross-realm Symbol keys, such as nodejs.util.promisify.custom, bypassing security guards and enabling arbitrary code execution.

The issue was fixed in version 3.11.4 by properly handling the receiver parameter and adding checks for dangerous Symbol keys.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to manipulate host-side behavior by injecting arbitrary properties into host objects from sandboxed code. This can lead to execution of arbitrary code or hijacking of important internal functions, such as those linked to nodejs.util.promisify.custom.

Because exploitation requires no privileges and no user interaction, it poses a significant security risk, potentially compromising the integrity of applications using the vulnerable vm2 versions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the vm2 library's BaseHandler.set trap ignoring the receiver parameter, allowing sandboxed code to write properties to host objects improperly.

To detect this vulnerability on your system, you can check the version of the vm2 library in use. Versions prior to 3.11.4 are vulnerable.

There are no specific network detection commands provided in the resources, but you can run the following command in your project directory to check the installed vm2 version:

• npm list vm2

If the version is less than 3.11.4, your system is vulnerable.

Additionally, you can audit your codebase for usage of vm2 and inspect if any untrusted sandboxed code is able to write properties to host objects via proxies or inherited objects, especially looking for suspicious writes involving Symbol keys like nodejs.util.promisify.custom.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the vm2 library to version 3.11.4 or later, where the vulnerability has been patched.

This update properly handles the receiver parameter in the BaseHandler.set trap and adds additional checks to prevent dangerous Symbol-keyed property writes.

If upgrading immediately is not possible, consider restricting or auditing the use of sandboxed code that relies on vm2 to prevent exploitation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in vm2 allows sandboxed code to write arbitrary properties, including dangerous Symbol-keyed properties, to host objects. This can lead to unauthorized manipulation of host-side behavior and potentially arbitrary code execution.

Such unauthorized access and control over host objects could result in breaches of data integrity and security, which are critical aspects of compliance with standards like GDPR and HIPAA.

If exploited in environments handling sensitive personal or health data, this vulnerability could lead to violations of confidentiality and integrity requirements mandated by these regulations.

Useful 0 Not Useful 0