{"vulnerability": "cve-2022-36067", "sightings": [{"uuid": "74a66b65-363c-49d4-b890-b676f0f98477", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/3635", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aThis repo contains payload for the CVE-2022-36067\nURL\uff1ahttps://github.com/Prathamrajgor/Exploit-For-CVE-2022-36067\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-12-26T14:37:37.000000Z"}, {"uuid": "a1777e88-a0c1-45b0-912b-5830b89f76ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/itsec_news/1775", "content": "\u200b\u26a1\ufe0f \u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Backstage \u043e\u0442 Spotify.\n\n\ud83d\udcac \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u043c\u0443 \u043e\u0442\u0447\u0435\u0442\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Oxeye, RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (\u0438\u043c\u0435\u0435\u0442 \u043e\u0446\u0435\u043d\u043a\u0443 9.8 \u0438\u0437 10 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 CVSS), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u201c\u0441\u0431\u0435\u0436\u0430\u0442\u044c \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b vm2\u201d \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 \u044f\u0434\u0440\u0430 Scaffolder \u2013 \u044d\u0442\u043e CVE-2022-36067 \u0438\u043b\u0438 Sandbreak, \u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438 \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435.\n\n\u041a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0440\u0435\u0448\u044c \u0432 \u0437\u0430\u0449\u0438\u0442\u0435 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \u201csoftware templates\u201d, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0432 Backstage. \u041f\u043e\u044d\u0442\u043e\u043c\u0443, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u0448\u0430\u0431\u043b\u043e\u043d\u0438\u0437\u0430\u0442\u043e\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 vm2 \u0434\u043b\u044f \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0437\u0430\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u0435\u043d\u0430\u0434\u0435\u0436\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, Sandbreak \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0448\u0435\u043b\u043b-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0436\u0435\u0440\u0442\u0432\u044b.\n\nOxeye \u0437\u0430\u044f\u0432\u0438\u043b\u0430, \u0447\u0442\u043e \u0435\u0439 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c \u0432 \u0421\u0435\u0442\u0438 \u0431\u043e\u043b\u0435\u0435 500 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Backstage, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u043b\u0438 \u0431\u044b\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0431\u0435\u0437 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u043c\u0438 Backstage \u0443\u0436\u0435 \u0434\u0430\u0432\u043d\u043e \u2013 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 1.5.1, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 29 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2022 \u0433\u043e\u0434\u0430.\n\n#Spotify #RCE\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-11-18T15:34:34.000000Z"}, {"uuid": "dc8673e2-a8d8-4f66-a395-e4efc615c2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/kasraone_com/318", "content": "\ud83d\udd34CVE-2022-36067 ?\n\n\nCVE-2022-36067 \u06cc\u06a9 \u0628\u0627\u06af \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u0628\u0631\u062e\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0634\u0631\u06a9\u062a Microsoft \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f. \u0627\u06cc\u0646 \u0628\u0627\u06af \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0633\u0631\u0648\u06cc\u0633 Active Directory Federation Services (ADFS) \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0647\u06a9\u0631\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u062d\u0633\u0627\u0628\u200c\u0647\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0631\u0627 \u0628\u062f\u0647\u062f.\n\n\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u0628\u0627\u06af\u060c \u0647\u06a9\u0631\u0627\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u062a\u0644\u0627\u0634 \u06a9\u0646\u0646\u062f \u062a\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u06a9\u0627\u0631\u0628\u0631\u060c \u0628\u0647 \u062d\u0633\u0627\u0628 \u0622\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0646\u0646\u062f. \u0647\u0645\u0686\u0646\u06cc\u0646\u060c \u0622\u0646\u200c\u0647\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u062a\u0648\u0627\u0646\u0646\u062f \u0628\u0647 \u0635\u0648\u0631\u062a \u0646\u0627\u0645\u062d\u0633\u0648\u0633 \u062f\u0631 \u0634\u0628\u06a9\u0647 \u0634\u0645\u0627 \u062d\u0636\u0648\u0631 \u06cc\u0627\u0628\u0646\u062f \u0648 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0645\u0646\u0627\u0628\u0639 \u062d\u0633\u0627\u0633 \u0631\u0627 \u0628\u062f\u0633\u062a \u0622\u0648\u0631\u0646\u062f.\n\nMicrosoft \u0642\u0628\u0644\u0627\u064b \u0686\u0646\u062f\u06cc\u0646 \u062a\u062d\u0630\u06cc\u0631 \u0631\u0627 \u062f\u0631 \u062e\u0635\u0648\u0635 CVE-2022-36067 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a \u0648 \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc ADFS \u0631\u0627 \u0628\u0647 \u0622\u062e\u0631\u06cc\u0646 \u0646\u0633\u062e\u0647 \u0628\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u06a9\u0646\u06cc\u062f. \u0647\u0645\u0686\u0646\u06cc\u0646\u060c \u0634\u0645\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0628\u0627 \u0641\u0639\u0627\u0644 \u0633\u0627\u0632\u06cc \u067e\u0631\u0648\u062a\u06a9\u0644 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0686\u0646\u062f \u0639\u0627\u0645\u0644\u06cc (MFA)\u060c \u062e\u0648\u062f \u0631\u0627 \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0627\u06cc\u0646 \u0646\u0648\u0639 \u062d\u0645\u0644\u0627\u062a \u0645\u062d\u0627\u0641\u0638\u062a \u06a9\u0646\u06cc\u062f", "creation_timestamp": "2023-06-27T08:52:09.000000Z"}, {"uuid": "bff5fe60-d1f3-4480-a2cd-e41c895e142c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/ctinow/68112", "content": "Critical vm2 sandbox escape flaw uncovered, patch ASAP! (CVE-2022-36067)\n\nhttps://ift.tt/fZ3w0DS", "creation_timestamp": "2022-10-10T12:21:17.000000Z"}, {"uuid": "869591ee-c8f8-4c20-868e-2e08b4e4a575", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "Telegram/suSVZ8gjh9CeURgOUMEZq2Z7fyo2iknJlY7RsYX9Hr2cvtw", "content": "", "creation_timestamp": "2023-01-20T07:08:40.000000Z"}, {"uuid": "1c632f93-20b5-400f-a76f-e5ce8dc30975", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/ZeroDay_TM/716", "content": "\u2022 This repo contains payload for the CVE-2022-36067\n\nhttps://github.com/Prathamrajgor/Exploit-For-CVE-2022-36067\n\n- - - - - - - - - - - - - - - - - - - -\n-=[ @ZeroDay_TM ]=-", "creation_timestamp": "2023-02-05T15:55:44.000000Z"}, {"uuid": "2b77e24c-63a6-403c-b9e9-712e001d4e87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/ZeroDay_TM/713", "content": "\u2022 This repo contains payload for the CVE-2022-36067\n\nLink: https://github.com/Prathamrajgor/Exploit-For-CVE-2022-36067\n\n- - - - - - - - - - - - - - - - - - - -\n-=[ @ZeroDay_TM ]=-", "creation_timestamp": "2023-01-31T01:48:03.000000Z"}, {"uuid": "bb9c1029-b8a0-4f0b-9fa0-037c8567ea15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/true_secator/3713", "content": "\u0412 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043f\u043e\u0440\u0442\u0430\u043b\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c Backstage \u043e\u0442 Spotify \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\n\n\u041f\u0440\u043e\u0434\u0443\u043a\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0439 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043a\u0440\u0443\u043f\u043d\u044b\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a American Airlines, Splunk, Fidelity Investments, Epic Games, Netflix, DoorDash, Roku, Expedia \u0438 \u0434\u0440\u0443\u0433\u0438\u043c\u0438.\n\n\u041e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Oxeye \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Spotify bug bounty.\n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 9,8 \u0438 \u0435\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c, \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0432 \u0440\u0430\u043d\u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 vm2, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u043a\u0430\u043a Sandbreak \u0438\u043b\u0438 CVE-2022-36067, \u0447\u0442\u043e \u0432 \u0438\u0442\u043e\u0433\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b vm2 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0411\u0430\u0433\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432 \u041f\u041e, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0432 Backstage.\n\n\u0412 \u0445\u043e\u0434\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u043b\u0438 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u0445\u0435\u0448\u0430 \u0444\u0430\u0432\u0438\u043a\u043e\u043d\u043a\u0438 Backstage \u0432 Shodan \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0431\u043e\u043b\u0435\u0435 500 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Backstage, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u0438, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u043c\u043d\u043e\u0433\u0438\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445, \u0442\u0430\u043a \u043a\u0430\u043a Backstage \u0431\u044b\u043b \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0431\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0423\u0433\u0440\u043e\u0437\u0443 \u043b\u043e\u043a\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b\u0438, \u043a\u043e\u043c\u0430\u043d\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 Backstage \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0432 \u0432\u0435\u0440\u0441\u0438\u044e 1.5.1. \u0435\u0449\u0435 \u0430\u0432\u0433\u0443\u0441\u0442\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430.", "creation_timestamp": "2022-11-16T15:26:04.000000Z"}, {"uuid": "bce00345-3d56-418b-b77c-38fa843f3b89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/thehackernews/2658", "content": "Researchers warn of a recently reported critical RCE vulnerability (CVE-2022-36067 / CVSS 10) in the popular vm2 JavaScript sandbox module that could be exploited by hackers to overcome security barriers and perform arbitrary operations.\n\nRead: https://thehackernews.com/2022/10/researchers-detail-critical-rce-flaw.html", "creation_timestamp": "2022-10-11T13:49:45.000000Z"}, {"uuid": "aa4a1cb7-2292-4d82-8b47-8b9e013cf1a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/BlueRedTeam/2567", "content": "#CVE-2022\nProof-of-concept app to overwrite fonts on iOS using CVE-2022-46689.\nhttps://github.com/zhuowei/WDBFontOverwrite\n\nThis repo contains payload for the CVE-2022-36067\nhttps://github.com/Prathamrajgor/Exploit-For-CVE-2022-36067\n\nProof of concept for CVE-2022-30190 (Follina).\n\nhttps://github.com/winstxnhdw/CVE-2022-30190\n\n@BlueRedTeam", "creation_timestamp": "2023-01-21T16:19:17.000000Z"}, {"uuid": "1623b564-e53b-467d-8677-2ff6d2fcb4a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/6594", "content": "Enter \"Sandbreak\" - Vulnerability In vm2 Sandbox Module Enables Remote Code Execution (CVE-2022-36067)\n\nhttps://www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067", "creation_timestamp": "2022-10-17T10:27:30.000000Z"}, {"uuid": "a8476ace-5fe8-4014-9593-4fe015b887b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/6979", "content": "#Threat_Research\n1. VM2 Sandbox Vulnerability (CVE-2022-36067)\nhttps://www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067\n2. Timing Attack to Detect Private Packages on npm\nhttps://blog.aquasec.com/private-packages-disclosed-via-timing-attack-on-npm", "creation_timestamp": "2022-10-15T13:07:01.000000Z"}, {"uuid": "1d2540b9-9b06-46ad-8149-d7d651dac3f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/3617", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-36067\nGithub: https://github.com/backcr4t/CVE-2022-36067-MASS-RCE\nDescribe: \nvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.", "creation_timestamp": "2026-08-02T00:01:21.437867Z"}, {"uuid": "c7c8651d-7b67-4adb-8c38-0cd6a0dc9e69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/3617", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-36067\nGithub: https://github.com/backcr4t/CVE-2022-36067-MASS-RCE\nDescribe: \nvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.", "creation_timestamp": "2026-08-01T01:00:05.282207Z"}, {"uuid": "d4af69d1-4c52-4857-a267-510e8a85657f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "Telegram/3fsQUWaB7Yu-f675nq595WXy09YE7H7udF1gESFpB7f0AiY", "content": "", "creation_timestamp": "2026-08-16T19:00:03.543484Z"}, {"uuid": "fdf31299-29b5-4b2c-b122-13a10cf6f886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "Telegram/3fsQUWaB7Yu-f675nq595WXy09YE7H7udF1gESFpB7f0AiY", "content": "", "creation_timestamp": "2026-08-17T00:00:11.751438Z"}, {"uuid": "2f855e4c-0b53-43a6-a21f-862187ed1ef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/CVEhub/3617", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-36067\nGithub: https://github.com/backcr4t/CVE-2022-36067-MASS-RCE\nDescribe: \nvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.", "creation_timestamp": "2026-07-29T12:00:58.196929Z"}, {"uuid": "f41bc76a-b279-43f8-ac58-6ced9bc272f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/CVEhub/3617", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-36067\nGithub: https://github.com/backcr4t/CVE-2022-36067-MASS-RCE\nDescribe: \nvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.", "creation_timestamp": "2026-07-30T00:01:36.951404Z"}, {"uuid": "ffceae50-08ae-435a-b37f-7b0627822474", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/hacking_Attack/72607", "content": "Black Hat Ethical Hacking\nCritical RCE Vulnerability Found in vm2 Sandbox Library\n\nCritical RCE Vulnerability Found in vm2 Sandbox LibraryPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Researchers are warning of a critical remote code execution flaw in \u2018vm2\u2019, a JavaScript sandbox library downloaded over 16 million times per month via the NPM package repository.The vm2 vulnerability is tracked as CVE-2022-36067 and received a severity rating of 10.0, the maximum score in the CVSS system, as it could allow attackers to escape the sandbox environment and run commands on a host system.\n\nSandboxes are meant to be an isolated environment that is walled off from the rest of the operating system. However, as developers commonly use sandboxes to run or test potentially unsafe code, the ability to \u201cescape\u201d from this confined environment and execute code on the host is a massive security problem.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Escaping the sandboxSecurity researchers at Oxeye have found a clever way to customize the call stack of an error that occurs in VM2 to generate \u201cCallSite\u201d objects created outside the sandbox and use them to access Node\u2019s global objects and execute commands.\n\nWhile the library\u2019s authors attempted to mitigate this possibility in the past, Oxeye\u2019s researchers found a way to bypass this mitigation mechanism by using a custom implementation of the \u201cprepareStackTrace\u201d method.\n\n\u201cThe reporter\u2019s POC bypassed the logic above since vm2 missed wrapping specific methods related to the \u201cWeakMap\u201d JavaScript built-in type,\u201d the researchers explain in their report. \n\n\u201cThis allowed the attacker to provide their own implementation of \u201cprepareStackTrace,\u201d then trigger an error, and escape the sandbox.\u201d\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/sandbox-escape-process.png \nUpdate as soon as possibleOxeye\u2019s research team discovered this critical problem on August 16, 2022, and reported it to the VM2 team a couple of days later, who confirmed they had launched an investigation.\n\nEventually, the authors of the popular library released version 3.9.11 on August 28, 2022, which addressed the sandbox escape and code execution problems.\n\nSoftware developers are urged to update to the latest VM2 version and replace older releases in their projects as soon as possible.\n\nFor end users, it is important to note that it could take a while before virtualization software tools relying on VM2 apply the available security update.\n\nAs we saw with Log4Shell, a critical security problem in a widely deployed open-source library may persist for extended periods without the impacted users even knowing they\u2019re vulnerable due to the obscurity in the supply chain.\n\nIf you use a sandbox solution, check if it relies on VM2 and whether it\u2019s using the latest version.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Secur[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:20.667218Z"}, {"uuid": "a90e6aa9-3ebe-43d6-9d13-4e73ff62eab3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "seen", "source": "https://t.me/hacking_Attack/72607", "content": "Black Hat Ethical Hacking\nCritical RCE Vulnerability Found in vm2 Sandbox Library\n\nCritical RCE Vulnerability Found in vm2 Sandbox LibraryPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Researchers are warning of a critical remote code execution flaw in \u2018vm2\u2019, a JavaScript sandbox library downloaded over 16 million times per month via the NPM package repository.The vm2 vulnerability is tracked as CVE-2022-36067 and received a severity rating of 10.0, the maximum score in the CVSS system, as it could allow attackers to escape the sandbox environment and run commands on a host system.\n\nSandboxes are meant to be an isolated environment that is walled off from the rest of the operating system. However, as developers commonly use sandboxes to run or test potentially unsafe code, the ability to \u201cescape\u201d from this confined environment and execute code on the host is a massive security problem.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Escaping the sandboxSecurity researchers at Oxeye have found a clever way to customize the call stack of an error that occurs in VM2 to generate \u201cCallSite\u201d objects created outside the sandbox and use them to access Node\u2019s global objects and execute commands.\n\nWhile the library\u2019s authors attempted to mitigate this possibility in the past, Oxeye\u2019s researchers found a way to bypass this mitigation mechanism by using a custom implementation of the \u201cprepareStackTrace\u201d method.\n\n\u201cThe reporter\u2019s POC bypassed the logic above since vm2 missed wrapping specific methods related to the \u201cWeakMap\u201d JavaScript built-in type,\u201d the researchers explain in their report. \n\n\u201cThis allowed the attacker to provide their own implementation of \u201cprepareStackTrace,\u201d then trigger an error, and escape the sandbox.\u201d\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/sandbox-escape-process.png \nUpdate as soon as possibleOxeye\u2019s research team discovered this critical problem on August 16, 2022, and reported it to the VM2 team a couple of days later, who confirmed they had launched an investigation.\n\nEventually, the authors of the popular library released version 3.9.11 on August 28, 2022, which addressed the sandbox escape and code execution problems.\n\nSoftware developers are urged to update to the latest VM2 version and replace older releases in their projects as soon as possible.\n\nFor end users, it is important to note that it could take a while before virtualization software tools relying on VM2 apply the available security update.\n\nAs we saw with Log4Shell, a critical security problem in a widely deployed open-source library may persist for extended periods without the impacted users even knowing they\u2019re vulnerable due to the obscurity in the supply chain.\n\nIf you use a sandbox solution, check if it relies on VM2 and whether it\u2019s using the latest version.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Secur[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:35.509951Z"}, {"uuid": "99eb536c-7a6d-4ddb-a6ef-3a41dc6ccc50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72607", "content": "Black Hat Ethical Hacking\nCritical RCE Vulnerability Found in vm2 Sandbox Library\n\nCritical RCE Vulnerability Found in vm2 Sandbox LibraryPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Researchers are warning of a critical remote code execution flaw in \u2018vm2\u2019, a JavaScript sandbox library downloaded over 16 million times per month via the NPM package repository.The vm2 vulnerability is tracked as CVE-2022-36067 and received a severity rating of 10.0, the maximum score in the CVSS system, as it could allow attackers to escape the sandbox environment and run commands on a host system.\n\nSandboxes are meant to be an isolated environment that is walled off from the rest of the operating system. However, as developers commonly use sandboxes to run or test potentially unsafe code, the ability to \u201cescape\u201d from this confined environment and execute code on the host is a massive security problem.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Escaping the sandboxSecurity researchers at Oxeye have found a clever way to customize the call stack of an error that occurs in VM2 to generate \u201cCallSite\u201d objects created outside the sandbox and use them to access Node\u2019s global objects and execute commands.\n\nWhile the library\u2019s authors attempted to mitigate this possibility in the past, Oxeye\u2019s researchers found a way to bypass this mitigation mechanism by using a custom implementation of the \u201cprepareStackTrace\u201d method.\n\n\u201cThe reporter\u2019s POC bypassed the logic above since vm2 missed wrapping specific methods related to the \u201cWeakMap\u201d JavaScript built-in type,\u201d the researchers explain in their report. \n\n\u201cThis allowed the attacker to provide their own implementation of \u201cprepareStackTrace,\u201d then trigger an error, and escape the sandbox.\u201d\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/sandbox-escape-process.png \nUpdate as soon as possibleOxeye\u2019s research team discovered this critical problem on August 16, 2022, and reported it to the VM2 team a couple of days later, who confirmed they had launched an investigation.\n\nEventually, the authors of the popular library released version 3.9.11 on August 28, 2022, which addressed the sandbox escape and code execution problems.\n\nSoftware developers are urged to update to the latest VM2 version and replace older releases in their projects as soon as possible.\n\nFor end users, it is important to note that it could take a while before virtualization software tools relying on VM2 apply the available security update.\n\nAs we saw with Log4Shell, a critical security problem in a widely deployed open-source library may persist for extended periods without the impacted users even knowing they\u2019re vulnerable due to the obscurity in the supply chain.\n\nIf you use a sandbox solution, check if it relies on VM2 and whether it\u2019s using the latest version.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Secur[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T06:00:05.539396Z"}, {"uuid": "a07b07ab-3eb9-4dd9-b683-74191a466076", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36067", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/72607", "content": "Black Hat Ethical Hacking\nCritical RCE Vulnerability Found in vm2 Sandbox Library\n\nCritical RCE Vulnerability Found in vm2 Sandbox LibraryPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Researchers are warning of a critical remote code execution flaw in \u2018vm2\u2019, a JavaScript sandbox library downloaded over 16 million times per month via the NPM package repository.The vm2 vulnerability is tracked as CVE-2022-36067 and received a severity rating of 10.0, the maximum score in the CVSS system, as it could allow attackers to escape the sandbox environment and run commands on a host system.\n\nSandboxes are meant to be an isolated environment that is walled off from the rest of the operating system. However, as developers commonly use sandboxes to run or test potentially unsafe code, the ability to \u201cescape\u201d from this confined environment and execute code on the host is a massive security problem.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Escaping the sandboxSecurity researchers at Oxeye have found a clever way to customize the call stack of an error that occurs in VM2 to generate \u201cCallSite\u201d objects created outside the sandbox and use them to access Node\u2019s global objects and execute commands.\n\nWhile the library\u2019s authors attempted to mitigate this possibility in the past, Oxeye\u2019s researchers found a way to bypass this mitigation mechanism by using a custom implementation of the \u201cprepareStackTrace\u201d method.\n\n\u201cThe reporter\u2019s POC bypassed the logic above since vm2 missed wrapping specific methods related to the \u201cWeakMap\u201d JavaScript built-in type,\u201d the researchers explain in their report. \n\n\u201cThis allowed the attacker to provide their own implementation of \u201cprepareStackTrace,\u201d then trigger an error, and escape the sandbox.\u201d\nhttps://www.bleepstatic.com/images/news/u/1220909/Diagrams/sandbox-escape-process.png \nUpdate as soon as possibleOxeye\u2019s research team discovered this critical problem on August 16, 2022, and reported it to the VM2 team a couple of days later, who confirmed they had launched an investigation.\n\nEventually, the authors of the popular library released version 3.9.11 on August 28, 2022, which addressed the sandbox escape and code execution problems.\n\nSoftware developers are urged to update to the latest VM2 version and replace older releases in their projects as soon as possible.\n\nFor end users, it is important to note that it could take a while before virtualization software tools relying on VM2 apply the available security update.\n\nAs we saw with Log4Shell, a critical security problem in a widely deployed open-source library may persist for extended periods without the impacted users even knowing they\u2019re vulnerable due to the obscurity in the supply chain.\n\nIf you use a sandbox solution, check if it relies on VM2 and whether it\u2019s using the latest version.\nTrending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Secur[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:55.769753Z"}]}