Exploitation Summary
EIP tracks 3 public exploits for CVE-2022-36067. PoCs published by prathamhasnotchanged, Prathamrajgor, 0x1nsomnia.
AI-analyzed exploit summary This repository contains a functional PoC exploit for CVE-2022-36067, a sandbox escape vulnerability in vm2 (Node.js VM module) versions <= 3.9.11. The exploit leverages manipulation of the `Error.prepareStackTrace` method to execute arbitrary OS commands via `child_process.execSync`.
Description
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
Exploits (3)
This repository contains a functional PoC exploit for CVE-2022-36067, a sandbox escape vulnerability in vm2 (Node.js VM module) versions <= 3.9.11. The exploit leverages manipulation of the `Error.prepareStackTrace` method to execute arbitrary OS commands via `child_process.execSync`.
This repository contains a functional exploit for CVE-2022-36067, leveraging a prototype pollution vulnerability in the vm2 sandbox to achieve remote code execution (RCE). The exploit manipulates the Error object's prepareStackTrace method to bypass sandbox restrictions and execute arbitrary commands.
This repository contains a functional proof-of-concept exploit for CVE-2022-36067, a vulnerability in the vm2 sandbox library. The exploit demonstrates remote code execution (RCE) by allowing users to upload and execute arbitrary JavaScript code in a vm2 sandbox via a web interface.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H