PT-2023-4526 · Node.Js · Node.Js

Colin Ihrig · Published 2023-06-20 · Updated 2024-12-16 · CVE-2023-30582

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Node.js version 20

Description A flaw has been identified in the experimental permission model of Node.js when the --allow-fs-read flag is used with a non-* argument. This issue arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API, allowing malicious actors to monitor files they do not have explicit read access to.

Recommendations For Node.js version 20, consider disabling the experimental permission model or restricting the use of the --allow-fs-read flag with non-* arguments until a patch is available. As a temporary workaround, avoid using the fs.watchFile API with sensitive files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-264

CWE-284

Related Identifiers

BDU:2023-04929

BIT-NODE-2023-30582

BIT-NODE-MIN-2023-30582

CVE-2023-30582

MGASA-2023-0226

OPENSUSE-SU-2024:13021-1

Affected Products

Node.Js

References · 28

• https://nvd.nist.gov/vuln/detail/CVE-2023-30582 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13021-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0226.html · Security Note
• https://bdu.fstec.ru/vul/2023-04929 · Security Note
• https://osv.dev/vulnerability/BIT-node-2023-30582 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-min-2023-30582 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0226 · Vendor Advisory
• https://github.com/nodejs/node/releases/tag/v18.16.1 · Note
• https://cybersecurity-help.cz/vdb/SB2023082320 · Note
• https://suse.com/security/cve/CVE-2023-30590 · Note
• https://t.me/cvenotify/93877 · Telegram Post
• https://nodejs.org/en/blog/vulnerability/june-2023-security-releases · Note
• https://bugs.mageia.org/show_bug.cgi?id=32047 · Note
• https://twitter.com/VulmonFeeds/status/1832499061968035878 · Twitter Post
• https://suse.com/security/cve/CVE-2023-30584 · Note