Permissions, Privileges, and Access Controls in Node.js - CVE-2023-30582

Vulnerability identifier: #VU77596

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30582

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to an error within the experimental permission model when the --allow-fs-read flag is used with a non-* argument. An inadequate permission model fails to restrict file watching through the fs.watchFile API and result in an ability of a remote user to monitor files that they do not have explicit read access to.

Node.js
IBM Business Automation Workflow
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Gentoo Linux
Oracle Solaris
Anolis OS
Voice Gateway
noslate-anode-npm
v8-devel
noslate-anode
noslate-anode-devel
noslate-anode-libs
noslate-anode-docs
noslate-anode-full-i18n
Platform Navigator in IBM Cloud Pak for Integration (CP4I)

Install updates from vendor's website.

Node.js - update to 20.3.1
Voice Gateway - addressed in versions 1.0.8.6, 1.0.8.10
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.3
IBM Spectrum Control - update to 5.4.10.2
noslate-anode-npm - update to 9.6.7-1.18.17.1.1
v8-devel - update to 10.2.154.26-1.18.17.1.1
noslate-anode - update to 18.17.1-1
noslate-anode-devel - update to 18.17.1-1
noslate-anode-libs - update to 18.17.1-1
noslate-anode-docs - update to 18.17.1-1
noslate-anode-full-i18n - update to 18.17.1-1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-11
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-12, 2023.2.1-1

• https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

• Multiple vulnerabilities in Node.js
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Control
• Gentoo update for Node.js
• Anolis OS update for noslate-anode