Exploitation Summary
EIP tracks 4 public exploits for CVE-2023-29017. PoCs published by timb-machine-mirrors, gunwoo105, GabrieleDattile.
AI-analyzed exploit summary The repository contains two functional exploit scripts for CVE-2023-29017, a sandbox escape vulnerability in vm2. Both scripts leverage prototype pollution and constructor manipulation to bypass the sandbox and execute arbitrary commands (e.g., 'touch flag').
Description
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
Exploits (4)
The repository contains two functional exploit scripts for CVE-2023-29017, a sandbox escape vulnerability in vm2. Both scripts leverage prototype pollution and constructor manipulation to bypass the sandbox and execute arbitrary commands (e.g., 'touch flag').
This repository provides a functional proof-of-concept for CVE-2023-29017, a vm2 sandbox escape vulnerability in versions ≤3.9.14. The exploit leverages unhandled async errors and the `Error.prepareStackTrace` mechanism to escape the vm2 sandbox and execute arbitrary commands on the host system via `child_process`.
The repository contains a functional PoC for CVE-2023-29017, demonstrating a reverse shell exploit using the 'vm2' library. The code includes a sandbox escape mechanism to execute arbitrary commands.
This repository contains a functional proof-of-concept exploit for CVE-2023-29017, leveraging a sandbox escape in the 'vm2' library to execute arbitrary commands via a reverse shell. The exploit manipulates the `Error.prepareStackTrace` function to spawn a reverse shell to a specified IP and port.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H