PT-2023-2417 · Vm2 · Vm2

Seunghyun Lee + 1 · Publicado 2023-04-17 · Atualizado 2026-05-06 · CVE-2023-30547

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions up to 3.9.16

Description The issue exists due to inadequate sanitization of special elements in the handleException() function of the vm2 library, allowing a remote attacker to escape the sandbox and execute arbitrary code in the host context. This can be achieved by raising an unsanitized host exception inside the handleException() function.

Recommendations For versions up to 3.9.16, upgrade to version 3.9.17 or later to resolve the issue. As a temporary workaround, consider disabling the handleException() function until a patch is available.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

BDU:2023-02202

CVE-2023-30547

GHSA-CH3R-J5X3-6Q2M

Produtos afetados

Vm2

Referências · 21

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30547.json · Exploit
• 🔥 https://github.com/rvizx/CVE-2023-30547 · Exploit
• 🔥 https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244 · Exploit
• https://github.com/patriksimek/vm2 · Nota
• https://github.com/patriksimek/vm2/releases/tag/3.9.17 · Nota
• https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049 · Correção
• https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5 · Correção
• https://t.me/true_secator/4299 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-02202 · Nota de Segurança
• https://t.me/cybersecuritytechnologies/8146 · Publicação no Telegram
• https://twitter.com/TheTechWorldPod/status/2017188696965972022 · Publicação no Twitter
• https://t.me/thehackernews/3257 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-30547 · Nota de Segurança
• https://t.me/pentestingnews/35117 · Publicação no Telegram