CVE-2023-29017

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29017", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-03-29T17:39:16.144Z", "datePublished": "2023-04-06T19:18:34.243Z", "dateUpdated": "2025-02-10T16:10:57.765Z"}, "containers": {"cna": {"title": "vm2 Sandbox Escape vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-913", "lang": "en", "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv"}, {"name": "https://github.com/patriksimek/vm2/issues/515", "tags": ["x_refsource_MISC"], "url": "https://github.com/patriksimek/vm2/issues/515"}, {"name": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50", "tags": ["x_refsource_MISC"], "url": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50"}, {"name": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d", "tags": ["x_refsource_MISC"], "url": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d"}], "affected": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"version": "< 3.9.15", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-06T19:18:34.243Z"}, "descriptions": [{"lang": "en", "value": "vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds."}], "source": {"advisory": "GHSA-7jxr-cg7f-gpgv", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:00:14.370Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv"}, {"name": "https://github.com/patriksimek/vm2/issues/515", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/patriksimek/vm2/issues/515"}, {"name": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50"}, {"name": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-10T16:10:48.424475Z", "id": "CVE-2023-29017", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T16:10:57.765Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv", "name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/patriksimek/vm2/issues/515", "name": "https://github.com/patriksimek/vm2/issues/515", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50", "name": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d", "name": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:00:14.370Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-29017", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-10T16:10:48.424475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T16:10:31.824Z"}}], "cna": {"title": "vm2 Sandbox Escape vulnerability", "source": {"advisory": "GHSA-7jxr-cg7f-gpgv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "< 3.9.15"}]}], "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv", "name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/patriksimek/vm2/issues/515", "name": "https://github.com/patriksimek/vm2/issues/515", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50", "name": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50", "tags": ["x_refsource_MISC"]}, {"url": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d", "name": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-913", "description": "CWE-913: Improper Control of Dynamically-Managed Code Resources"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-06T19:18:34.243Z"}}}, "cveMetadata": {"cveId": "CVE-2023-29017", "state": "PUBLISHED", "dateUpdated": "2025-02-10T16:10:57.765Z", "dateReserved": "2023-03-29T17:39:16.144Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-04-06T19:18:34.243Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "vm2", "vendor": "patriksimek", "versions": [{"status": "affected", "version": "< 3.9.15"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "ADA32E89-C69C-4459-9515-D3F7B53EFCAE", "versionEndExcluding": "3.9.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds."}], "id": "CVE-2023-29017", "lastModified": "2026-06-17T05:49:11.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-29017", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-10T16:10:48.424475Z", "version": "2.0.3"}}]}, "published": "2023-04-06T20:15:08.723", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit"], "url": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/patriksimek/vm2/issues/515"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/patriksimek/vm2/issues/515"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-913"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2023:1893", "cpe": "cpe:/a:redhat:multicluster_engine:2.0::el8", "package": "multicluster-engine-console-mce-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-04-20T00:00:00Z"}, {"advisory": "RHSA-2023:1894", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-console-mce-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-04-20T00:00:00Z"}, {"advisory": "RHSA-2023:1887", "cpe": "cpe:/a:redhat:multicluster_engine:2.2::el8", "package": "multicluster-engine/console-mce-rhel8:v2.2.3-13", "product_name": "multicluster engine for Kubernetes 2.2 for RHEL 8", "release_date": "2023-04-19T00:00:00Z"}, {"advisory": "RHSA-2023:1887", "cpe": "cpe:/a:redhat:multicluster_engine:2.2::el8", "package": "multicluster-engine/multicluster-engine-console-mce-rhel8:v2.2.3-13", "product_name": "multicluster engine for Kubernetes 2.2 for RHEL 8", "release_date": "2023-04-19T00:00:00Z"}, {"advisory": "RHSA-2023:1896", "cpe": "cpe:/a:redhat:acm:2.5::el8", "package": "console-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-04-20T00:00:00Z"}, {"advisory": "RHSA-2023:1897", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "console-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-04-20T00:00:00Z"}, {"advisory": "RHSA-2023:1888", "cpe": "cpe:/a:redhat:acm:2.7::el8", "package": "rhacm2/console-rhel8:v2.7.3-16", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2.7 for RHEL 8", "release_date": "2023-04-20T00:00:00Z"}], "bugzilla": {"description": "vm2: sandbox escape", "id": "2185374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2185374"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-755", "details": ["vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.", "A flaw was found in vm2 where the component was not properly handling asynchronous errors. This flaw allows a remote, unauthenticated attacker to escape the restrictions of the sandbox and execute code on the host."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2023-29017", "public_date": "2023-04-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-29017\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-29017\nhttps://github.com/patriksimek/vm2/issues/515\nhttps://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv"], "threat_severity": "Critical"}

{}