PT-2023-2209 · Npm · Vm2

Seongil Wi · Published 2023-04-06 · Updated 2026-05-06 · CVE-2023-29017

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.9.15

Description The issue is related to the incorrect handling of objects in memory by the Error.prepareStackTrace object in the vm2 library of the NPM package manager. This can allow a remote attacker to bypass sandbox protections and gain remote code execution rights on the host running the sandbox. The Error.prepareStackTrace function is vulnerable when handling host objects passed in case of unhandled async errors.

Recommendations For versions prior to 3.9.15, update to version 3.9.15 or later to patch the vulnerability. As a temporary workaround, consider restricting access to the Error.prepareStackTrace function until a patch is available.

Exploit

Fix

RCE

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-913

CWE-755

Related Identifiers

BDU:2023-01956

CVE-2023-29017

GHSA-7JXR-CG7F-GPGV

Affected Products

Vm2

References · 23

• 🔥 https://github.com/patriksimek/vm2/issues/515 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29017.json · Exploit
• 🔥 https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d · Exploit
• 🔥❌ https://github.com/Kaneki-hash/CVE-2023-29017-reverse-shell · Exploit, Deleted
• https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50 · Patch
• https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29017 · Security Note
• https://osv.dev/vulnerability/GHSA-7jxr-cg7f-gpgv · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01956 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://t.me/true_secator/4299 · Telegram Post
• https://twitter.com/OstorlabSec/status/2016640068933325034 · Twitter Post
• https://t.me/true_secator/4269 · Telegram Post
• https://twitter.com/TheTechWorldPod/status/2017188696965972022 · Twitter Post