CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 6CVE-2023-30547 – Sandbox Escape in vm2
https://notcve.org/view.php?id=CVE-2023-30547
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. ... A flaw was found in the vm2 sandbox. ... This issue may allow an attacker to bypass the sandbox protections, which can lead to remote code execution on the hypervisor host or the host that is running the sandbox. • https://github.com/rvizx/CVE-2023-30547 https://github.com/Cur1iosity/CVE-2023-30547 https://github.com/user0x1337/CVE-2023-30547 https://github.com/junnythemarksman/CVE-2023-30547 https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244 https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049 https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5 https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m https://access.redhat.com/security/cve&# • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2023-2017 – Improper Control of Generation of Code in Twig Rendered Views in Shopware
https://notcve.org/view.php?id=CVE-2023-2017
Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. ... This is a bypass of CVE-2023-22731. • https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2023 https://github.com/shopware/platform/security/advisories/GHSA-7v2v-9rm4-7m8f https://starlabs.sg/advisories/23/23-2017 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-184: Incomplete List of Disallowed Inputs CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 1CVE-2023-29199 – vm2 Sandbox escape vulnerability
https://notcve.org/view.php?id=CVE-2023-29199
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. ... A flaw was found in the vm2 sandbox. ... This issue may allow an attacker to bypass the sandbox protections which can lead to remote code execution on the hypervisor host or the host which is running the sandbox. • https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c https://github.com/patriksimek/vm2/commit/24c724daa7c09f003e556d7cd1c7a8381cb985d7 https://github.com/patriksimek/vm2/issues/516 https://github.com/patriksimek/vm2/releases/tag/3.9.16 https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985 https://access.redhat.com/security/cve/CVE-2023-29199 https://bugzilla.redhat.com/show_bug.cgi?id=2187409 • CWE-755: Improper Handling of Exceptional Conditions CWE-913: Improper Control of Dynamically-Managed Code Resources •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 8CVE-2023-26122
https://notcve.org/view.php?id=CVE-2023-26122
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. • https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cce https://github.com/hacksparrow/safe-eval/issues/27 https://github.com/hacksparrow/safe-eval/issues/31 https://github.com/hacksparrow/safe-eval/issues/32 https://github.com/hacksparrow/safe-eval/issues/33 https://github.com/hacksparrow/safe-eval/issues/34 https://github.com/hacksparrow/safe-eval/issues/35 https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373064 • CWE-265: Privilege Issues CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2023-26919
https://notcve.org/view.php?id=CVE-2023-26919
delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the loadWithNewGlobal function can be used to invoke the exit and quit methods to exit the Java process. • https://github.com/javadelight/delight-nashorn-sandbox/issues/135 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •