PT-2023-4531 · Node.Js · Node.Js

Mattaustin

·

Published

2023-06-20

·

Updated

2024-12-16

·

CVE-2023-30587

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:C/A:N
Name of the Vulnerable Software and Affected Versions Node.js version 20
Description A vulnerability in Node.js allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl. This vulnerability exclusively affects Node.js users employing the permission model mechanism, which is an experimental feature of Node.js.
Recommendations For Node.js version 20, upgrade to version 20.3.1 to resolve the issue. As a temporary workaround, consider disabling the inspector module until a patch is available. Restrict access to the Worker class to minimize the risk of exploitation. Avoid using the kIsInternal Symbol in the Worker constructor until the issue is resolved.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2023-04935
BIT-NODE-2023-30587
BIT-NODE-MIN-2023-30587
CVE-2023-30587
MGASA-2023-0226
OPENSUSE-SU-2024:13021-1

Affected Products

Node.Js