Improper access control in Node.js - CVE-2023-30587

Vulnerability identifier: #VU77595

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30587

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can exploit the Worker class's ability to create an "internal worker" with the kIsInternal Symbol to bypass restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).

Node.js
IBM Business Automation Workflow
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
IBM Spectrum Symphony
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Gentoo Linux
Oracle Solaris
Anolis OS
Voice Gateway
noslate-anode-npm
v8-devel
noslate-anode
noslate-anode-devel
noslate-anode-libs
noslate-anode-docs
noslate-anode-full-i18n
Platform Navigator in IBM Cloud Pak for Integration (CP4I)

Install updates from vendor's website.

Node.js - update to 20.3.1
Voice Gateway - addressed in versions 1.0.8.6, 1.0.8.10
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.3
IBM Spectrum Control - update to 5.4.10.2
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
noslate-anode-npm - update to 9.6.7-1.18.17.1.1
v8-devel - update to 10.2.154.26-1.18.17.1.1
noslate-anode - update to 18.17.1-1
noslate-anode-devel - update to 18.17.1-1
noslate-anode-libs - update to 18.17.1-1
noslate-anode-docs - update to 18.17.1-1
noslate-anode-full-i18n - update to 18.17.1-1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-11
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-12, 2023.2.1-1

• https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

• Multiple vulnerabilities in Node.js
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Spectrum Control
• Gentoo update for Node.js
• Anolis OS update for noslate-anode