Lucene search

K
osvGoogleOSV:GHSA-P5GC-C584-JJ6V
HistoryMay 17, 2023 - 3:49 a.m.

vm2 vulnerable to Inspect Manipulation

2023-05-1703:49:37
Google
osv.dev
17

0.001 Low

EPSS

Percentile

31.2%

In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log.

Impact

A threat actor can edit options for console.log.

Patches

This vulnerability was patched in the release of version 3.9.18 of vm2.

Workarounds

After creating a vm make the inspect method readonly with vm.readonly(inspect).

References

PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550

For more information

If you have any questions or comments about this advisory:

  • Open an issue in VM2

Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.

CPENameOperatorVersion
vm2lt3.9.18

0.001 Low

EPSS

Percentile

31.2%