PT-2023-4523 · Node.Js · Node.Js

Axel Chong · Published 2023-06-20 · Updated 2024-12-16 · CVE-2023-30584

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Node.js version 20

Description A vulnerability has been discovered in Node.js, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. The vulnerability may allow a remote attacker to impact the integrity of protected information due to incorrect restriction of the directory path name with limited access.

Recommendations For Node.js version 20, as a temporary workaround, consider disabling the experimental permission model until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using the vulnerable permission model in production environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-04926

BIT-NODE-2023-30584

BIT-NODE-MIN-2023-30584

CVE-2023-30584

MGASA-2023-0226

OPENSUSE-SU-2024:13021-1

Affected Products

Node.Js

References · 34

• https://advisories.mageia.org/MGASA-2023-0226.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-30584 · Security Note
• https://bdu.fstec.ru/vul/2023-04926 · Security Note
• https://osv.dev/vulnerability/BIT-node-min-2023-30584 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2023-30584 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0226 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13021-1 · Vendor Advisory
• https://github.com/nodejs/node/releases/tag/v18.16.1 · Note
• https://suse.com/security/cve/CVE-2023-30590 · Note
• https://twitter.com/cracbot/status/1834109746271715347 · Twitter Post
• https://bugs.mageia.org/show_bug.cgi?id=32047 · Note
• https://suse.com/security/cve/CVE-2023-30584 · Note
• https://suse.com/security/cve/CVE-2023-30588 · Note
• https://t.me/cibsecurity/72477 · Telegram Post
• https://t.me/cvenotify/93686 · Telegram Post