Path traversal in Node.js - CVE-2023-30584

Vulnerability identifier: #VU77594

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30584

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error within the experimental permission model when verifying file permissions. A remote user can send a specially crafted request and read arbitrary files on the system.

Node.js
IBM Business Automation Workflow
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
IBM Spectrum Symphony
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Gentoo Linux
Anolis OS
Oracle Solaris
Voice Gateway
nodejs-nodemon
noslate-anode-npm
v8-devel
npm
noslate-anode
noslate-anode-devel
noslate-anode-libs
noslate-anode-docs
noslate-anode-full-i18n
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-docs
nodejs-packaging
nodejs-packaging-bundler
Platform Navigator in IBM Cloud Pak for Integration (CP4I)

Install update from vendor's website.

Node.js - update to 20.3.1
Voice Gateway - addressed in versions 1.0.8.6, 1.0.8.10
nodejs-nodemon - update to 3.0.1-1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.3
IBM Spectrum Control - update to 5.4.10.2
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
noslate-anode-npm - update to 9.6.7-1.18.17.1.1
v8-devel - update to 10.2.154.26-1.18.17.1.1
npm - update to 10.8.1-1.20.16.0.1
noslate-anode - update to 18.17.1-1
noslate-anode-devel - update to 18.17.1-1
noslate-anode-libs - update to 18.17.1-1
noslate-anode-docs - update to 18.17.1-1
noslate-anode-full-i18n - update to 18.17.1-1
nodejs - update to 20.16.0-1
nodejs-devel - update to 20.16.0-1
nodejs-full-i18n - update to 20.16.0-1
nodejs-docs - update to 20.16.0-1
nodejs-packaging - update to 2021.06-4
nodejs-packaging-bundler - update to 2021.06-4
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-11
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-12, 2023.2.1-1

• https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

• Multiple vulnerabilities in Node.js
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Spectrum Control
• Gentoo update for Node.js
• Anolis OS update for noslate-anode
• Anolis OS update for nodejs:20 module