GHSA-22rr-f3p8-5gf8 Directus affected by VM2 sandbox escape vulnerability
Attackers can escape the VM2 sandbox in Directus flows to execute arbitrary code in the main Node.js context.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-22rr-f3p8-5gf8?
GHSA-22rr-f3p8-5gf8 is a code injection vulnerability in directus, published on 15 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox running code in the main nodejs context.
Patches
Patched in v10.6.0 by replacing vm2 with isolated-vm
Workarounds
None
References
https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
Which versions are affected by GHSA-22rr-f3p8-5gf8?
2 open source packages ship an affected version, including directus.
| Package | Affected | Fixed in |
|---|---|---|
directus npm | All versions | 10.6.0 |
directus npm | All versions | 10.6.0 |
How do I fix GHSA-22rr-f3p8-5gf8?
Upgrade directus to 10.6.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-22rr-f3p8-5gf8 being exploited?
There is no known exploitation of GHSA-22rr-f3p8-5gf8 in the wild and no public exploit code.