CVE-2022-39266

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/laverdet/isolated-vm/commit/218e87a6d4e8cb818bea76d1ab30cd0be51920e8
https://github.com/laverdet/isolated-vm/commits/v4.3.7
https://github.com/laverdet/isolated-vm/issues/379
https://github.com/laverdet/isolated-vm/security/advisories/GHSA-2jjq-x548-rhpv	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:isolated-vm_project:isolated-vm:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2022-09-29 18:15

Updated : 2023-08-24 23:15

NVD link : CVE-2022-39266

Mitre link : CVE-2022-39266

CVE.ORG link : CVE-2022-39266

JSON object : View

Products Affected

isolated-vm_project

isolated-vm

CWE

CWE-20

Improper Input Validation

CWE-693

Protection Mechanism Failure

NVD-CWE-Other

{"id": "CVE-2022-39266", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "published": "2022-09-29T18:15:10.227", "references": [{"url": "https://github.com/laverdet/isolated-vm/commit/218e87a6d4e8cb818bea76d1ab30cd0be51920e8", "source": "security-advisories@github.com"}, {"url": "https://github.com/laverdet/isolated-vm/commits/v4.3.7", "source": "security-advisories@github.com"}, {"url": "https://github.com/laverdet/isolated-vm/issues/379", "source": "security-advisories@github.com"}, {"url": "https://github.com/laverdet/isolated-vm/security/advisories/GHSA-2jjq-x548-rhpv", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-693"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user."}, {"lang": "es", "value": "isolated-vm es una biblioteca para nodejs que da acceso a la interfaz Isolate de v8. En versiones 4.3.6 y anteriores, si los datos en cach\u00e9 de v8 que no son confiables son pasados a la API mediante CachedDataOptions, los atacantes pueden omitir el sandbox y ejecutar c\u00f3digo arbitrario en el proceso de nodejs. En el momento de la publicaci\u00f3n, no son conocidas versiones corregidas ni mitigaciones"}], "lastModified": "2023-08-24T23:15:07.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:isolated-vm_project:isolated-vm:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "85E8608D-5CD0-4BE5-A9F0-230492B48439", "versionEndIncluding": "4.3.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}