Description

vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak

Summary

vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server.

Details

In lib/setup-sandbox.js:436-466, the CallSite class overrides getThis() and getFunction() with undefined to prevent host object references from leaking into the sandbox. However, the following methods pass through unsanitized values from the original V8 CallSite object:

getFileName() — returns host absolute paths like /app/node_modules/vm2/lib/vm.js

getLineNumber(), getColumnNumber() — exact source locations

getFunctionName(), getMethodName(), getTypeName() — internal function names

Two exploitation paths exist:

Default error.stack: new Error().stack includes host frame paths in the formatted string

Custom prepareStackTrace: Attacker can set Error.prepareStackTrace to directly call getFileName() on each CallSite, extracting a clean list of all host paths

PoC

Library-level PoC (Node.js script — primary):

const { VM } = require("vm2");
const vm = new VM();

// Path A — Default error.stack
const result1 = vm.run(`try { null.x; } catch(e) { e.stack }`);
console.log(result1);
// Output includes: /app/node_modules/vm2/lib/vm.js:289:18
//                   /app/src/server.js:49:20...
Show more

HTTP demonstration:

# Default error.stack
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"try { null.x; } catch(e) { e.stack }"}'

# prepareStackTrace extraction
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \...
Show more

Impact

Information Disclosure: Host directory structure, library paths, framework versions, and internal architecture are exposed to sandboxed code.

Attack Chain: Leaked paths enable precise targeting for other vulnerabilities.

Scope: All applications using vm2. No special configuration required.

Mitigation

Aliases

References