GHSA-4mq4-7rw3-vm5j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-4mq4-7rw3-vm5j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-4mq4-7rw3-vm5j/GHSA-4mq4-7rw3-vm5j.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-4mq4-7rw3-vm5j
- Aliases
- Published
- 2023-12-13T13:32:38Z
- Modified
- 2024-01-03T16:44:36Z
- Severity
-
- 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Wasmer filesystem sandbox not enforced
- Details
-
Summary
As of Wasmer version v4.2.3, Wasm programs can access the filesystem outside of the sandbox.
Details
https://github.com/wasmerio/wasmer/issues/4267
PoC
A minimal Rust program:
fn main() { let f = std::fs::OpenOptions::new() .write(true) .create_new(true) .open("abc") .unwrap(); }This should be compiled with
cargo build --target wasm32-wasi. The compiled program, when run with wasmer WITHOUT--dir, can still create a file in the working directory.Impact
Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem.
- Database specific
{ "nvd_published_at": "2023-12-22T15:15:08Z", "cwe_ids": [ "CWE-284" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-12-13T13:32:38Z" }- References
-
- https://github.com/wasmerio/wasmer/security/advisories/GHSA-4mq4-7rw3-vm5j
- https://nvd.nist.gov/vuln/detail/CVE-2023-51661
- https://github.com/wasmerio/wasmer/issues/4267
- https://github.com/wasmerio/wasmer/commit/4d63febf9d8b257b0531963b85df48d45d0dbf3c
- https://github.com/wasmerio/wasmer/commit/e3923612c23123025c26f982d390e34df7df030f
- https://github.com/wasmerio/wasmer
Affected packages
crates.io / wasmer-cli
Package
- Name
- wasmer-cli
- View open source insights on deps.dev
- Purl
- pkg:cargo/wasmer-cli