Attack Chain

1. An attacker injects malicious JavaScript code into a NodeVM instance configured with nesting: true but without explicitly setting the require option.
2. The initial security check in nodevm.js at line 263 fails because options.require is undefined instead of false, thus bypassing the intended restriction.
3. The code inside the NodeVM then uses require('vm2') to gain access to the vm2 library itself.
4. The injected code constructs a new, nested NodeVM instance, this time explicitly enabling the child_process module via require: { builtin: ['child_process'] }.
5. The nested NodeVM instance is then used to execute arbitrary operating system commands using child_process.execSync().
6. The output of the command is converted to a string.
7. The string is returned as the result of the initial nvm.run() call, demonstrating successful command execution on the host.
8. The attacker achieves full remote code execution on the host system.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the host system. In a multi-tenant environment or any situation where vm2 is used to sandbox untrusted code, this can lead to complete system compromise. The attacker can gain access to sensitive data, install malware, or pivot to other systems on the network. The observed damage is full RCE.

Recommendation

• Upgrade to a patched version of vm2 that addresses this vulnerability.
• Apply the suggested fix to nodevm.js locally if an immediate upgrade is not possible: Change the check to if (options.nesting === true && !options.require) as documented in the advisory.
• Deploy the Sigma rules provided to detect attempts to exploit this vulnerability, focusing on process_creation events originating from within vm2 sandboxes.
• Monitor for unusual require() calls within vm2 sandboxes, especially those attempting to load the child_process module.