SB2023081012 - Multiple vulnerabilities in Node.js

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32002)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions for the Module._load() method. A remote attacker can bypass the policy mechanism and include modules outside of the policy.json definition for a given module.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32006)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions for the module.constructor.createRequire() method. A remote attacker can bypass the policy mechanism and include modules outside of the policy.json definition for a given module.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32559)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to usage of deprecated API process.binding(). A remote attacker can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file.

4) Path traversal (CVE-ID: CVE-2023-32558)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the deprecated API process.binding(). A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

5) Path traversal (CVE-ID: CVE-2023-32004)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to improper handling of Buffers in file system APIs. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-32005)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an inadequate permission model that fails to restrict file stats through the fs.statfs API. A remote user can retrieve stats from files that they do not have explicit read access to.

7) Path traversal (CVE-ID: CVE-2023-32003)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to a missing check in the fs.mkdtemp() API. A remote attacker can bypass the permission model check using a path traversal attack in fs.mkdtemp() and fs.mkdtempSync().

Remediation

Install update from vendor's website.

References

• https://nodejs.org/en/blog/vulnerability/august-2023-security-releases
• https://github.com/nodejs/node/releases/tag/v16.20.2
• https://github.com/nodejs/node/releases/tag/v18.17.1
• https://github.com/nodejs/node/releases/tag/v20.5.1