Earlier this week, an update was released for a critical sandbox vulnerabilities in vm2 (CVE-2023-29017 and CVE-2023-29199) , which ultimately allows for remote code execution by an attacker. vm2 is a widely used module within the Node.js library that provides a sandbox environment. Successfully exploiting both vulnerabilities allows attackers to execute untrusted code on the host system by running and escaping a sandbox on the vulnerable vm2 modules. Why is this Significant?This is significant because vm2 is a popular built-in module in Node.js. Furthermore – proof-of-concept (PoC) code is publicly available for CVE-2023-29017 and CVE-2023-29199. Although the latest vm2 version (3.9.16) includes a fix for both CVE’s , threat actors are expected to exploit these soon – due to availability of publicly available POCs. As such, users should upgrade vm2 to version 3.9.16 as soon as possible.What is CVE-2023-29017?The vulnerability leverages vulnerable vm2 versions not properly handling host objects passed to “Error.prepareStackTrace” in case of unhandled async errors. Successfully exploiting the vulnerability allows attackers to execute untrusted code on the host system by running a sandbox created by the vulnerable vm2 modules.Is an Advisory Available for CVE-2023-29017?Yes, see the Appendix for a link to “Sandbox Escape (CVE-2023-29017)”.What Version of vm2 is Vulnerable to CVE-2023-29017?vm2 versions 3.9.15 and prior are vulnerable to CVE-2023-29017.What is the CVSS score for CVE-2023-29017?The vulnerability has a CVSS score of 9.8 and is rated “CRITICAL” according to the advisory page for vm2.What is CVE-2023-29199?CVE-2023-29199 is a sandbox escape vulnerability for vm2 caused by an improper leak of unsanitized host exceptions. This type of vulnerability could allow an attacker to execute untrusted code on the host running a sandbox created by the vulnerable vm2 modules.The vulnerability has a CVSS score of 9.8 and is rated “CRITICAL” according to the advisory.What Version of vm2 is Vulnerable CVE-2023-29199?vm2 versions 3.9.15 and prior are vulnerable to CVE-2023-29199.Is an Advisory Available for CVE-2023-29199?Yes, see the Appendix for a link to “Sandbox Escape (CVE-2023-29199)”.Is a Patch Available for CVE-2023-29199?Yes, the issue is fixed in vm2 version 3.9.16 or later.How Widespread is the Issue?At this time, it appears to be unknown. This could become a major issue given the popularity of vm2. While there are no reports of the vulnerabilities being widely exploited in the wild, threat actors will start incorporating them in their arsenal, as PoCs are becoming readily available. What is the Status of Protection?FortiGuard Labs has updated IPS signature “vm2.Sandbox.Error.prepareStackTrace.Remote.Code.Execution” to include CVE-2023-29017 and released it in version 23.532.FortiGuard Labs is currently investigating protection for CVE-2023-29199 and will update this Threat Signal when new information becomes available.FortiGuard Labs has an Outbreak Alert page published for this issue under “VM2 Sandbox Escape Vulnerability” which contains additional details on protections available beyond AV and IPS coverage.Any Recommended Mitigation?Currently no known mitigation is available. Users should update vm2 to 3.9.16 as soon as possible.

Read More

Multiple security issues were discovered in Chromium, which could result
in the execution of arbitrary code.

Read More

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. The diff formatter using rouge can block for a long time in Sidekiq jobs without any timeout.

Read More

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API insecure direct object reference.

Read More

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via the Kubernetes integration, leading (for example) to disclosure of a GCP service token.

Read More

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Cross Site Request Forgery (CSRF) in the Slack integration for issuing slash commands.

Read More

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery (SSRF) via a loopback address to the validate_localhost function in url_blocker.rb.

Read More

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers may have been able to obtain sensitive access-token data from Sentry logs via the GRPC::Unknown exception.

Read More

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.

Read More

An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference to the “merge request approvals” feature.

Read More