PT-2022-4708 · Backstage+2 · Backstage+2

Oxeye-Daniel · Published 2022-09-06 · Updated 2026-05-06 · CVE-2022-36067

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.9.11

Description The issue is related to insufficient resource control with dynamic management in the vm2 library, allowing a remote attacker to execute arbitrary code by bypassing sandbox protections. The vulnerability affects the vm2 sandbox, which can run untrusted code with whitelisted Node's built-in modules. It is estimated that over 500 instances of Backstage, a popular developer portal, are vulnerable to this issue, with many of them accessible without authentication due to default deployment settings. The vulnerability was patched in version 3.9.11 of vm2.

Recommendations For versions prior to 3.9.11, update to version 3.9.11 or later to resolve the issue. As a temporary workaround, consider disabling the use of the vm2 sandbox until a patch is applied. Restrict access to the vm2 module to minimize the risk of exploitation. Avoid using the vm2 sandbox to run untrusted code until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-913

Related Identifiers

BDU:2022-05598

CVE-2022-36067

GHSA-MRGP-MRHC-5JRQ

Affected Products

Backstage

Node

Vm2

References · 22

• 🔥 https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36067.json · Exploit
• 🔥 https://github.com/Prathamrajgor/Exploit-For-CVE-2022-36067 · Exploit
• 🔥 https://oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067 · Exploit
• https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq · Patch
• https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164 · Patch
• https://bdu.fstec.ru/vul/2022-05598 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-36067 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36067 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mrgp-mrhc-5jrq · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/issues/467 · Note
• https://t.me/pentestingnews/29164 · Telegram Post
• https://t.me/thehackernews/2658 · Telegram Post
• https://twitter.com/TheTechWorldPod/status/2017188696965972022 · Twitter Post