PT-2023-4531 · Node.Js · Node.Js
Mattaustin
·
Publicado
2023-06-20
·
Atualizado
2024-12-16
·
CVE-2023-30587
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Node.js version 20
Description
A vulnerability in Node.js allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl. This vulnerability exclusively affects Node.js users employing the permission model mechanism, which is an experimental feature of Node.js.
Recommendations
For Node.js version 20, upgrade to version 20.3.1 to resolve the issue. As a temporary workaround, consider disabling the inspector module until a patch is available. Restrict access to the Worker class to minimize the risk of exploitation. Avoid using the
kIsInternal Symbol in the Worker constructor until the issue is resolved.Correção
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Node.Js