Exploitation Summary
EIP tracks 5 public exploits for CVE-2023-30547. PoCs published by rvizx, rvzsec, Cur1iosity.
AI-analyzed exploit summary This repository contains a functional PoC exploit for CVE-2023-30547, a VM2 sandbox escape vulnerability. The exploit leverages exception sanitization flaws to achieve arbitrary code execution in the host context.
Description
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Exploits (5)
This repository contains a functional PoC exploit for CVE-2023-30547, a VM2 sandbox escape vulnerability. The exploit leverages exception sanitization flaws to achieve arbitrary code execution in the host context.
This repository contains a functional exploit for CVE-2023-30547, a VM2 sandbox escape vulnerability. The exploit leverages a flaw in exception sanitization to achieve arbitrary code execution by manipulating the prototype chain and throwing a proxied error.
This repository contains a Python-based exploit for CVE-2023-30547, a sandbox escape vulnerability in vm2 versions up to 3.9.16. The exploit leverages exception sanitization flaws to execute arbitrary commands, spawn reverse shells, or establish web shells on vulnerable targets.
This PoC exploits CVE-2023-30547 in vm2 sandbox by leveraging unsanitized host exceptions to escape the sandbox and execute arbitrary code. It sends a base64-encoded payload via HTTP POST to a vulnerable endpoint, triggering a reverse shell.
This is a functional Proof-of-Concept exploit for CVE-2023-30547, a vm2 sandbox escape vulnerability. It leverages a prototype pollution technique to achieve remote code execution (RCE) via a reverse shell.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H