PT-2021-14488 · Node.Js · Isolated-Vm

Cristianstaicu + 1 · Published 2021-03-30 · Updated 2021-04-07 · CVE-2021-21413

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions isolated-vm versions prior to 4.0.0

Description The isolated-vm library for Node.js has API pitfalls that may expose supposed secure isolates to the permissions of the main Node.js isolate. Reference objects allow access to the underlying reference's full prototype chain, potentially enabling attackers to acquire a Reference to the Node.js context's Function object. Similar attacks could be possible by modifying the local prototype of other API objects. Access to NativeModule objects could allow an attacker to load and run native code from anywhere on the filesystem, potentially leading to arbitrary code execution if combined with a file upload API.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later, which includes changes such as updated documentation, modified Reference instances to not follow prototype chains by default, immutable isolated-vm API prototypes, and restrictions on invoking the NativeModule constructor.

Fix

Weakness Enumeration

CWE-913

Related Identifiers

CVE-2021-21413

GHSA-MMHJ-4W6J-76H7

Affected Products

Isolated-Vm

References · 8

• https://github.com/laverdet/isolated-vm/commit/2646e6c1558bac66285daeab54c7d490ed332b15 · Patch
• https://github.com/laverdet/isolated-vm/commit/27151bfecc260e96714443613880e3b2e6596704 · Patch
• https://osv.dev/vulnerability/GHSA-mmhj-4w6j-76h7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21413 · Security Note
• https://github.com/laverdet/isolated-vm/blob/main/CHANGELOG.md#v400 · Note
• https://github.com/laverdet/isolated-vm/security/advisories/GHSA-mmhj-4w6j-76h7 · Note
• https://t.me/cvenotify/12834 · Telegram Post