PT-2023-3681 · Vm2 · Vm2

Leesh3288 · Publicado 2023-07-13 · Atualizado 2026-06-13 · CVE-2023-37903

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions up to and including 3.9.19

Description The issue in vm2 allows attackers to escape the sandbox and run arbitrary code, potentially resulting in Remote Code Execution. This is possible due to the Node.js custom inspect function. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. The vulnerability exists because of the lack of measures to neutralize special elements used in the operating system command.

Recommendations For versions up to and including 3.9.19, as a temporary workaround, consider disabling the custom inspect function until a patch is available. However, since there are no patches and no known workarounds, users are advised to find an alternative software. Avoid using the vm2 sandbox for emulation until the issue is resolved.

Exploit

Correção

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-03966

CVE-2023-37903

GHSA-G644-9GFX-Q4Q4

Produtos afetados

Vm2

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37903.json · Exploit
• 🔥 https://github.com/7h3h4ckv157/CVE-2023-37903 · Exploit
• https://github.com/patriksimek/vm2 · Nota
• https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4 · Aviso do Fabricante
• https://twitter.com/TheTechWorldPod/status/2017188696965972022 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-g644-9gfx-q4q4 · Aviso do Fabricante
• https://t.me/cybersecuritytechnologies/9336 · Publicação no Telegram
• https://security.netapp.com/advisory/ntap-20230831-0007 · Nota
• https://twitter.com/TheTechWorldPod/status/2017188699151155585 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-03966 · Nota de Segurança
• https://twitter.com/SecAlertsCo/status/2060807163757437048 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-37903 · Nota de Segurança
• https://t.me/cvenotify/55645 · Publicação no Telegram
• https://twitter.com/SecAlertsCo/status/2060747048161312825 · Publicação no Twitter
• https://twitter.com/DFIR_Lab/status/2065604950781018114 · Publicação no Twitter