Exploitation Summary
EIP tracks 3 public exploits for CVE-2023-29017. PoCs published by timb-machine-mirrors, GabrieleDattile, passwa11.
AI-analyzed exploit summary The repository contains two functional exploit scripts for CVE-2023-29017, a sandbox escape vulnerability in vm2. Both scripts leverage prototype pollution and constructor manipulation to bypass the sandbox and execute arbitrary commands (e.g., 'touch flag').
Description
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
Exploits (3)
The repository contains two functional exploit scripts for CVE-2023-29017, a sandbox escape vulnerability in vm2. Both scripts leverage prototype pollution and constructor manipulation to bypass the sandbox and execute arbitrary commands (e.g., 'touch flag').
The repository contains a functional PoC for CVE-2023-29017, demonstrating a reverse shell exploit using the 'vm2' library. The code includes a sandbox escape mechanism to execute arbitrary commands.
This repository contains a functional proof-of-concept exploit for CVE-2023-29017, leveraging a sandbox escape in the 'vm2' library to execute arbitrary commands via a reverse shell. The exploit manipulates the `Error.prepareStackTrace` function to spawn a reverse shell to a specified IP and port.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H