CVE-2021-21413

描述

Versions of `isolated-vm` before v4.0.0, and especially before v3.0.0, have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. `Reference` objects allow access to the underlying reference's full prototype chain. In an environment where the implementer has exposed a `Reference` instance to an attacker they would be able to use it to acquire a `Reference` to the nodejs context's `Function` object. Similar application-specific attacks could be possible by modifying the local prototype of other API objects. Access to `NativeModule` objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution. To address these issues the following changes were made in v4.0.0: - Documentation was updated with more explicit guidelines on building secure applications. - `Reference` instances will no longer follow prototype chains by default, nor will they invoke accessors or proxies. - All `isolated-vm` API prototypes are now immutable. - `NativeModule` constructor may only be invoked from a nodejs isolate.

如何修補 CVE-2021-21413

要修補 CVE-2021-21413,請將受影響套件升級到下列已修補版本。

• —升級至 4.0.0 或更新版本

CVE-2021-21413 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 4.0.0

CVSS 分數