Permissions, Privileges, and Access Controls in Node.js - CVE-2023-30583

Vulnerability identifier: #VU77599

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30583

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to a missing check in the fs.openAsBlob() API. A remote user leverage fs.openAsBlob() to bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag.

Node.js
IBM Business Automation Workflow
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Gentoo Linux
Oracle Solaris
Anolis OS
Voice Gateway
noslate-anode-npm
v8-devel
noslate-anode
noslate-anode-devel
noslate-anode-libs
noslate-anode-docs
noslate-anode-full-i18n
Platform Navigator in IBM Cloud Pak for Integration (CP4I)

Install updates from vendor's website.

Node.js - update to 20.3.1
Voice Gateway - addressed in versions 1.0.8.6, 1.0.8.10
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.3
IBM Spectrum Control - update to 5.4.10.2
noslate-anode-npm - update to 9.6.7-1.18.17.1.1
v8-devel - update to 10.2.154.26-1.18.17.1.1
noslate-anode - update to 18.17.1-1
noslate-anode-devel - update to 18.17.1-1
noslate-anode-libs - update to 18.17.1-1
noslate-anode-docs - update to 18.17.1-1
noslate-anode-full-i18n - update to 18.17.1-1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-11
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-12, 2023.2.1-1

• https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

• Multiple vulnerabilities in Node.js
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Control
• Gentoo update for Node.js
• Anolis OS update for noslate-anode