PT-2023-31873 · Wasmer · Wasmer

Yagehu · Published 2023-12-13 · Updated 2024-01-03 · CVE-2023-51661

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wasmer versions prior to 4.2.4

Description The issue affects Wasmer, a WebAssembly runtime, allowing Wasm programs to access the filesystem outside of the sandbox. This can lead to service providers running untrusted Wasm code on Wasmer unexpectedly exposing the host filesystem.

Recommendations For versions prior to 4.2.4, update to version 4.2.4 to resolve the issue. As a temporary workaround, consider restricting access to untrusted Wasm code until the update is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-51661

GHSA-4MQ4-7RW3-VM5J

Affected Products

Wasmer

References · 11

• 🔥 https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51661.json · Exploit
• https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3c · Patch
• https://osv.dev/vulnerability/CVE-2023-51661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51661 · Security Note
• https://osv.dev/vulnerability/GHSA-4mq4-7rw3-vm5j · Vendor Advisory
• https://github.com/wasmerio/wasmer/commit/e3923612c23123025c26f982d390e34df7df030f · Note
• https://github.com/wasmerio/wasmer · Note
• https://github.com/wasmerio/wasmer/issues/4267 · Note
• https://t.me/cvenotify/66011 · Telegram Post
• https://twitter.com/cracbot/status/1738624110521925844 · Twitter Post