PT-2023-4525 · Node.Js · Node.Js

Colin Ihrig

·

Publicado

2023-06-20

·

Atualizado

2024-12-16

·

CVE-2023-30583

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Node.js version 20
Description The issue is related to the fs.openAsBlob() method in Node.js, which can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag. This flaw arises from a missing check in the fs.openAsBlob() API. The permission model is an experimental feature of Node.js.
Recommendations For Node.js version 20, consider disabling the fs.openAsBlob() function until a patch is available to prevent bypassing the experimental permission model. Restrict access to the file system read restriction with the --allow-fs-read flag to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284CWE-264

Identificadores relacionados

BDU:2023-04928
BIT-NODE-2023-30583
BIT-NODE-MIN-2023-30583
CVE-2023-30583
MGASA-2023-0226
OPENSUSE-SU-2024:13021-1

Produtos afetados

Node.Js