{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/vm2--3.11.1/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["vm2 (\u003c= 3.11.1)"],"_cs_severities":["critical"],"_cs_tags":["sandbox-escape","rce","javascript"],"_cs_type":"advisory","_cs_vendors":["npm"],"content_html":"\u003cp\u003eA critical sandbox escape vulnerability has been identified in vm2 versions 3.11.1 and earlier. This flaw allows an attacker to bypass the intended security restrictions of the vm2 sandbox, gaining the ability to execute arbitrary code on the host system. The vulnerability stems from the \u003ccode\u003eneutralizeArraySpeciesBatch\u003c/code\u003e method, which improperly handles objects from different contexts. By exploiting this, an attacker can gain access to host objects, including the host \u003ccode\u003eFunction\u003c/code\u003e object, effectively breaking out of the sandbox. This poses a significant risk to applications relying on vm2 for secure code execution, as it could lead to complete system compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker injects malicious JavaScript code into the vm2 sandbox.\u003c/li\u003e\n\u003cli\u003eThe injected code manipulates the \u003ccode\u003eArray.prototype\u003c/code\u003e using \u003ccode\u003eObject.defineProperty\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eneutralizeArraySpeciesBatch\u003c/code\u003e method is triggered, which attempts to neutralize objects passed between the sandbox and the host.\u003c/li\u003e\n\u003cli\u003eThe code leverages a getter on the array prototype to expose objects from the host environment into the sandbox.\u003c/li\u003e\n\u003cli\u003eThe attacker obtains a reference to the host\u0026rsquo;s \u003ccode\u003eBuffer.prototype.inspect\u003c/code\u003e function through the exposed objects.\u003c/li\u003e\n\u003cli\u003eThe attacker uses \u003ccode\u003eBuffer.prototype.inspect.constructor.constructor\u003c/code\u003e to obtain a reference to the host\u0026rsquo;s \u003ccode\u003eFunction\u003c/code\u003e constructor.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eFunction\u003c/code\u003e constructor is then used to execute arbitrary code on the host system, such as using \u003ccode\u003echild_process.execSync\u003c/code\u003e to create a file.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves remote code execution on the host, bypassing the vm2 sandbox.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows attackers to execute arbitrary commands on the host system. This can lead to complete system compromise, data exfiltration, or denial-of-service. Given the widespread use of vm2 in sandboxing JavaScript code, a successful attack could have significant consequences for many applications and systems. The vulnerability has been assigned CVE-2026-44008 and is rated as critical severity.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of vm2 (later than 3.11.1) to remediate CVE-2026-44008.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026ldquo;Detect VM2 Sandbox Escape via Array Prototype Manipulation\u0026rdquo; to identify exploitation attempts within your environment.\u003c/li\u003e\n\u003cli\u003eEnable process creation logging to allow for detection of commands executed by the escaped sandbox, as identified by the Sigma rule \u0026ldquo;Detect Host Command Execution from VM2 Sandbox\u0026rdquo;.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T17:00:00Z","date_published":"2024-01-03T17:00:00Z","id":"/briefs/2024-01-vm2-sandbox-breakout/","summary":"A sandbox breakout vulnerability in vm2 allows attackers to execute arbitrary commands on the host system by exploiting the `neutralizeArraySpeciesBatch` method to access host objects and the Function object.","title":"VM2 Sandbox Breakout via neutralizeArraySpeciesBatch Method","url":"https://feed.craftedsignal.io/briefs/2024-01-vm2-sandbox-breakout/"}],"language":"en","title":"CraftedSignal Threat Feed — Vm2 (\u003c= 3.11.1)","version":"https://jsonfeed.org/version/1.1"}