PT-2023-2352 · Vm2 · Vm2

Seunghyun Lee + 1 · Published 2023-04-12 · Updated 2026-01-30 · CVE-2023-29199

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions up to 3.9.15

Description The issue is related to the source code transformer's exception sanitization logic in vm2, allowing attackers to bypass the handleException() function and leak unsanitized host exceptions. This can be used to escape the sandbox and run arbitrary code in the host context, giving a threat actor remote code execution rights on the host running the sandbox.

Recommendations For versions up to 3.9.15, update to version 3.9.16 to patch the vulnerability. As a temporary workaround, consider disabling the handleException() function until a patch is available. Restrict access to the vm2 sandbox to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-913

Related Identifiers

BDU:2023-02119

CVE-2023-29199

GHSA-XJ72-WVFV-8985

Affected Products

Vm2

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29199.json · Exploit
• 🔥 https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c · Exploit
• https://github.com/patriksimek/vm2/issues/516 · Patch
• https://github.com/patriksimek/vm2/commit/24c724daa7c09f003e556d7cd1c7a8381cb985d7 · Patch
• https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29199 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29199 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xj72-wvfv-8985 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02119 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/3.9.16 · Note
• https://t.me/true_secator/4299 · Telegram Post
• https://t.me/cvenotify/49031 · Telegram Post
• https://twitter.com/TheTechWorldPod/status/2017188696965972022 · Twitter Post
• https://t.me/thehackernews/3257 · Telegram Post