PT-2023-4525 · Node.Js · Node.Js

Colin Ihrig

·

Published

2023-06-20

·

Updated

2024-12-16

·

CVE-2023-30583

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Node.js version 20
Description The issue is related to the fs.openAsBlob() method in Node.js, which can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag. This flaw arises from a missing check in the fs.openAsBlob() API. The permission model is an experimental feature of Node.js.
Recommendations For Node.js version 20, consider disabling the fs.openAsBlob() function until a patch is available to prevent bypassing the experimental permission model. Restrict access to the file system read restriction with the --allow-fs-read flag to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284CWE-264

Related Identifiers

BDU:2023-04928
BIT-NODE-2023-30583
BIT-NODE-MIN-2023-30583
CVE-2023-30583
MGASA-2023-0226
OPENSUSE-SU-2024:13021-1

Affected Products

Node.Js