CVE-2023-51661 Filesystem sandbox not enforced in wasmer-cli
Attackers can escape the filesystem sandbox to read or modify host files when running untrusted WebAssembly code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-51661?
CVE-2023-51661 is a high-severity path traversal vulnerability in wasmerio wasmer, published on 22 Dec 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.
Weakness: CWE-284
Which versions are affected by CVE-2023-51661?
2 open source packages ship an affected version, including wasmer-cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wasmer-cli crates.io | From 3.0.0 | 4.2.4 |
wasmer-cli crates.io | From 3.0.0 | 4.2.4 |
Products include Wasmer Wasmer.
How do I fix CVE-2023-51661?
Upgrade wasmer-cli to 4.2.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-51661 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-51661 exists.
Sources
Also known as GHSA-4mq4-7rw3-vm5j.