In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log.
Impact
A threat actor can edit options for console.log.
Patches
This vulnerability was patched in the release of version 3.9.18 of vm2.
Workarounds
After creating a vm make the inspect method readonly with vm.readonly(inspect).
References
PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
For more information
If you have any questions or comments about this advisory:
Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.
In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node
inspectmethod and edit options forconsole.log.Impact
A threat actor can edit options for
console.log.Patches
This vulnerability was patched in the release of version
3.9.18ofvm2.Workarounds
After creating a vm make the
inspectmethod readonly withvm.readonly(inspect).References
PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
For more information
If you have any questions or comments about this advisory:
Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.