PT-2023-2417 · Vm2 · Vm2

Seunghyun Lee + 1 · Published 2023-04-17 · Updated 2026-05-06 · CVE-2023-30547

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions up to 3.9.16

Description The issue exists due to inadequate sanitization of special elements in the handleException() function of the vm2 library, allowing a remote attacker to escape the sandbox and execute arbitrary code in the host context. This can be achieved by raising an unsanitized host exception inside the handleException() function.

Recommendations For versions up to 3.9.16, upgrade to version 3.9.17 or later to resolve the issue. As a temporary workaround, consider disabling the handleException() function until a patch is available.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2023-02202

CVE-2023-30547

GHSA-CH3R-J5X3-6Q2M

Affected Products

Vm2

References · 21

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30547.json · Exploit
• 🔥 https://github.com/rvizx/CVE-2023-30547 · Exploit
• 🔥 https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244 · Exploit
• https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049 · Patch
• https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5 · Patch
• https://osv.dev/vulnerability/GHSA-ch3r-j5x3-6q2m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30547 · Security Note
• https://bdu.fstec.ru/vul/2023-02202 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30547 · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/3.9.17 · Note
• https://t.me/true_secator/4299 · Telegram Post
• https://t.me/pentestingnews/35117 · Telegram Post
• https://t.me/freedomf0x/20713 · Telegram Post