Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

sec: critical vulnerability in transitive dep vm2 (via superagent-proxy) #380

Closed
rafaeltc opened this issue Jul 14, 2023 · 2 comments · Fixed by #389
Closed

sec: critical vulnerability in transitive dep vm2 (via superagent-proxy) #380

rafaeltc opened this issue Jul 14, 2023 · 2 comments · Fixed by #389
Assignees
@vreynolds
Labels
status: oncall Flagged for awareness from Honeycomb Telemetry Oncall type: security Security issues/fixes.

Comments

@rafaeltc
Copy link

Versions

  • Libhoney: v4.0.1

Description

In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. The vm2 project alerts to the existence of critical security issues and claims to have been discontinued, therefore recommending replacing vm2 with isolated-vm.
@rafaeltc rafaeltc added the type: security Security issues/fixes. label Jul 14, 2023
@robbkidd
Copy link
Member

robbkidd commented Jul 14, 2023 •
edited
Loading

We're keeping an eye on upstream for a fix for the moment.

In the meantime, here's some information about Honeycomb's use of vm2:

What's This Mean For A Libhoney User?

(according to our current understanding, confirmed upstream)

  • No HTTP_PROXY or HTTPS_PROXY set for your Node services using libhoney: ✅
    • vulnerable vm2 library is not loaded in your application runtime by libhoney
  • HTTP_PROXY/HTTPS_PROXY are set, but do not use a proxy auto-config URL: 🆗
    • vulnerable vm2 library may be loaded, but is not in the execution path of libhoney operations.
  • HTTP_PROXY/HTTPS_PROXY are set to use a proxy auto-config URL: ❓
    • exposure to the vulnerability in vm2 depends on the contents of the PAC file served by that URL endpoint

@robbkidd robbkidd self-assigned this Jul 14, 2023
@robbkidd robbkidd mentioned this issue Jul 14, 2023
Closed
@pkanal pkanal added the status: oncall Flagged for awareness from Honeycomb Telemetry Oncall label Jul 17, 2023
@robbkidd robbkidd changed the title vm2 Sandbox Escape vulnerability sec: critical vulnerability in transitive dep vm2 (via superagent-proxy) Jul 17, 2023
@robbkidd
Copy link
Member

robbkidd commented Jul 18, 2023 •
edited
Loading

proxy-agent release 6.3.0 contains a fix in f1f3220d1.

superagent-proxy's dependency on proxy-agent is currently ^5.0.0 (>=5.0.0, < 6). Awaiting an update to the version constraint there—maybe from this PR?—and a release.

@robbkidd robbkidd mentioned this issue Aug 4, 2023
Merged
3 tasks
robbkidd added a commit that referenced this issue Aug 16, 2023
@robbkidd @JamieDanielson
fix: replace superagent-proxy with direct use of proxy-agent (#389)
798855a 
## Which problem is this PR solving?

- Resolves #380 

## Short description of the changes

This is the equivalent behavior of the previous agent configuration. If
a proxy URL is provided in libhoney config, a single ProxyAgent will be
created with that proxy URL set for all connections. No nuanced lookup
of proxy config from the environment based on target URL protocol.

[proxy-agent is a hefty
import](https://bundlephobia.com/package/[email protected]), but we were
importing an early edition of it
([v5.0.0](https://bundlephobia.com/package/[email protected])) already
via superagent-proxy. 

---------

Co-authored-by: JamieDanielson <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vreynolds vreynolds

Labels
status: oncall Flagged for awareness from Honeycomb Telemetry Oncall type: security Security issues/fixes.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: replace superagent-proxy with direct use of proxy-agent honeycombio/libhoney-js
5 participants
@robbkidd @rafaeltc @vreynolds @pkanal @JamieDanielson