Permissions, Privileges, and Access Controls in Node.js - CVE-2023-32005

Vulnerability identifier: #VU79339

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32005

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to an inadequate permission model that fails to restrict file stats through the fs.statfs API. A remote user can retrieve stats from files that they do not have explicit read access to.

Node.js
IBM Business Automation Workflow
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Netcool Operations Insight
IBM Watson Assistant for IBM Cloud Pak for Data
Gentoo Linux
Fedora
IBM Business Automation Manager Open Editions
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Answer Retrieval for Watson Discovery On Prem
Voice Gateway
nodejs16
nodejs18
nodejs20

Install updates from vendor's website.

Node.js - update to 20.5.1
IBM Business Automation Manager Open Editions - update to 9.0.1
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - update to 2023.2.1-1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-12
Voice Gateway - addressed in versions 1.0.8.8, 1.0.8.12
Netcool Operations Insight - update to 1.6.11
Answer Retrieval for Watson Discovery On Prem - update to 2.14.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.4
nodejs16 - addressed in versions 16.20.2-1.fc37, 16.20.2-1.fc38
nodejs18 - addressed in versions 18.17.1-1.fc37, 18.17.1-1.fc38
nodejs20 - addressed in versions 20.5.1-1.fc37, 20.5.1-1.fc38

• https://github.com/nodejs/node/releases/tag/v20.5.1
• https://nodejs.org/en/blog/vulnerability/august-2023-security-releases

• Multiple vulnerabilities in Node.js
• Fedora 38 update for nodejs16, nodejs18, nodejs20
• Fedora 37 update for nodejs16, nodejs18, nodejs20
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Watson Assistant For IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Gentoo update for Node.js