Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the vm2 library and allows for a sandbox escape leading to Remote Code Execution (RCE). The root cause is an improper validation of the require option within the NodeVM constructor when the nesting option is enabled. The check typeof requireOpts === 'object' && requireOpts !== null is insufficient because it returns true for arrays ([]), which are not valid configuration objects. When an attacker provides an array for the require option, the check is bypassed. Subsequently, the makeResolverFromLegacyOptions function processes this malformed input. It destructures the array, resulting in undefined configuration fields, but still applies the NESTING_OVERRIDE. This override exposes the host's vm2 module to the sandbox. An attacker can then use this exposed module to create a new, nested NodeVM instance with a malicious configuration (e.g., allowing child_process), thereby escaping the sandbox and executing arbitrary commands on the host system. The fix involves introducing a stricter check, isPlainConfigObject, which correctly identifies and rejects non-plain objects like arrays, thus closing the vulnerability.
NodeVM.constructorlib/nodevm.js
makeResolverFromLegacyOptionslib/resolver-compat.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vm2 | npm | >= 3.11.4, <= 3.11.6 | 3.11.7 |
VMRequiremakeResolverFromLegacyOptions()builtinexternalNESTING_OVERRIDENodeVMrequireFailed shape check: https://github.com/patriksimek/vm2/blob/54b54b74a382577f0bcd0538c5bf99acdcd7f53b/lib/nodevm.js#L304-L307
An attacker can execute arbitrary commands with the host Node.js process privileges, including reading secrets, modifying files, and accessing the host network. GHSA-m4wx-m65x-ghrr covers the same nesting primitive but does not cover array-shaped require values and incorrectly identifies 3.11.4 as patched.
Exploitation is limited to downstream applications that enable
nestingand pass the malformed array configuration.