PT-2023-3681 · Vm2 · Vm2

Leesh3288 · Published 2023-07-13 · Updated 2026-06-13 · CVE-2023-37903

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions up to and including 3.9.19

Description The issue in vm2 allows attackers to escape the sandbox and run arbitrary code, potentially resulting in Remote Code Execution. This is possible due to the Node.js custom inspect function. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. The vulnerability exists because of the lack of measures to neutralize special elements used in the operating system command.

Recommendations For versions up to and including 3.9.19, as a temporary workaround, consider disabling the custom inspect function until a patch is available. However, since there are no patches and no known workarounds, users are advised to find an alternative software. Avoid using the vm2 sandbox for emulation until the issue is resolved.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-03966

CVE-2023-37903

GHSA-G644-9GFX-Q4Q4

Affected Products

Vm2

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37903.json · Exploit
• 🔥 https://github.com/7h3h4ckv157/CVE-2023-37903 · Exploit
• https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g644-9gfx-q4q4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03966 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-37903 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37903 · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://twitter.com/TheTechWorldPod/status/2017188696965972022 · Twitter Post
• https://t.me/cybersecuritytechnologies/9336 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230831-0007 · Note
• https://twitter.com/TheTechWorldPod/status/2017188699151155585 · Twitter Post
• https://twitter.com/SecAlertsCo/status/2060807163757437048 · Twitter Post
• https://t.me/cvenotify/55645 · Telegram Post
• https://twitter.com/SecAlertsCo/status/2060747048161312825 · Twitter Post