Path traversal in Node.js - CVE-2023-32558

Vulnerability identifier: #VU79336

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32558

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the deprecated API process.binding(). A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Node.js
IBM Business Automation Workflow
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Netcool Operations Insight
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Spectrum Control
Gentoo Linux
Fedora
IBM Business Automation Manager Open Editions
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Answer Retrieval for Watson Discovery On Prem
Voice Gateway
nodejs16
nodejs18
nodejs20

Install update from vendor's website.

Node.js - update to 20.5.1
IBM Business Automation Manager Open Editions - update to 9.0.1
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - update to 2023.2.1-1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-12
Voice Gateway - addressed in versions 1.0.8.8, 1.0.8.12
Netcool Operations Insight - update to 1.6.11
Answer Retrieval for Watson Discovery On Prem - update to 2.14.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.4
IBM Spectrum Control - update to 5.4.10.2
nodejs16 - addressed in versions 16.20.2-1.fc37, 16.20.2-1.fc38
nodejs18 - addressed in versions 18.17.1-1.fc37, 18.17.1-1.fc38
nodejs20 - addressed in versions 20.5.1-1.fc37, 20.5.1-1.fc38

• https://github.com/nodejs/node/releases/tag/v20.5.1
• https://nodejs.org/en/blog/vulnerability/august-2023-security-releases

• Multiple vulnerabilities in Node.js
• Fedora 38 update for nodejs16, nodejs18, nodejs20
• Fedora 37 update for nodejs16, nodejs18, nodejs20
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Watson Assistant For IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Gentoo update for Node.js