Path traversal in Node.js - CVE-2023-32004

Vulnerability identifier: #VU79337

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32004

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to improper handling of Buffers in file system APIs. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Node.js
IBM Business Automation Workflow
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Netcool Operations Insight
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Spectrum Control
Gentoo Linux
Anolis OS
Fedora
IBM Business Automation Manager Open Editions
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Answer Retrieval for Watson Discovery On Prem
Voice Gateway
nodejs-nodemon
npm
nodejs16
nodejs18
nodejs20
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-docs
nodejs-packaging
nodejs-packaging-bundler

Install update from vendor's website.

Node.js - update to 20.5.1
IBM Business Automation Manager Open Editions - update to 9.0.1
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - update to 2023.2.1-1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-12
Voice Gateway - addressed in versions 1.0.8.8, 1.0.8.12
Netcool Operations Insight - update to 1.6.11
Answer Retrieval for Watson Discovery On Prem - update to 2.14.0
nodejs-nodemon - update to 3.0.1-1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.4
IBM Spectrum Control - update to 5.4.10.2
npm - update to 10.8.1-1.20.16.0.1
nodejs16 - addressed in versions 16.20.2-1.fc37, 16.20.2-1.fc38
nodejs18 - addressed in versions 18.17.1-1.fc37, 18.17.1-1.fc38
nodejs20 - addressed in versions 20.5.1-1.fc37, 20.5.1-1.fc38
nodejs - update to 20.16.0-1
nodejs-devel - update to 20.16.0-1
nodejs-full-i18n - update to 20.16.0-1
nodejs-docs - update to 20.16.0-1
nodejs-packaging - update to 2021.06-4
nodejs-packaging-bundler - update to 2021.06-4

• https://github.com/nodejs/node/releases/tag/v20.5.1
• https://nodejs.org/en/blog/vulnerability/august-2023-security-releases

• Multiple vulnerabilities in Node.js
• Fedora 38 update for nodejs16, nodejs18, nodejs20
• Fedora 37 update for nodejs16, nodejs18, nodejs20
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Spectrum Control
• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Watson Assistant For IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Gentoo update for Node.js
• Anolis OS update for nodejs:20 module