Published: 14/04/2023 Updated: 25/04/2023

CVSS v3 Base Score: 10 | Impact Score: 6 | Exploitability Score: 3.9

VMScore: 0

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing malicious users to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vm2 project vm2

Synopsis Critical: Multicluster Engine for Kubernetes 223 security updates and bug fixes Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 223 General Availability release images, which fix bugs and security updates container imagesRed Hat Product Security has rated this update as having a security impact ...

Synopsis Critical: Multicluster Engine for Kubernetes 20 hotfix security update for console Type/Severity Security Advisory: Critical Topic Red Hat Multicluster Engine Hotfix Security Update for ConsoleRed Hat Product Security has rated this update as having a security impactof Critical A Common Vulnerability Scoring System (CVSS) base scor ...

Synopsis Critical: Red Hat Advanced Cluster Management 26 hotfix security update for console Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes hotfix security update for consoleRed Hat Product Security has rated this update as having a security impactof Critical A Common Vulnerability Scoring ...

Synopsis Critical: Multicluster Engine for Kubernetes 21 hotfix security update for console Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 21 hotfix security update for consoleRed Hat Product Security has rated this update as having a security impactof Critical A Common Vulnerability Scoring System (CVSS ...

Synopsis Critical: Red Hat Advanced Cluster Management 273 security fixes and bug fixes Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 273 GeneralAvailability release images, which fix bugs and security updates container imagesRed Hat Product Security has rated this update as having a s ...

Synopsis Critical: Red Hat Advanced Cluster Management 25 hotfix security update for console Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes hotfix security update for consoleRed Hat Product Security has rated this update as having a security impactof Critical A Common Vulnerability Scoring ...

DescriptionThe MITRE CVE dictionary describes this issue as: There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3915, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context A ...

In this repository you can find the Codify server write up and the exploit used to make the privilege escalation.

Write up First of all, before starting to explain how has been pwned Codify, I'm going to show you all the concepts that are used to vulnerate this server: An NodeJs vulnerability is exploited to gain access as user CVS (user with minimum privileges) An exaustive system enumeration is needed to detect an ''db'' file Cracking hashes Abusing SUDOERS p

CWE-913 https://github.com/patriksimek/vm2/releases/tag/3.9.16 https://github.com/patriksimek/vm2/issues/516 https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985 https://github.com/patriksimek/vm2/commit/24c724daa7c09f003e556d7cd1c7a8381cb985d7 https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:1887 https://github.com/3mpir3Albert/HTB_Codify https://access.redhat.com/security/cve/cve-2023-29199

CVE-2023-29199

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect