PT-2023-4549 · Node.Js+9 · Node.Js+9
Leodog896
·
Published
2023-08-09
·
Updated
2025-07-01
·
CVE-2023-32559
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Node.js versions 16.x through 20.x
Description
A privilege escalation issue exists in the experimental policy mechanism due to inadequate access controls. This can be exploited by a remote attacker to bypass existing security restrictions. The use of the deprecated API
process.binding() can bypass the policy mechanism, allowing an attacker to require internal modules and eventually execute arbitrary code outside of the limits defined in a policy.json file. The policy is an experimental feature of Node.js.Recommendations
For Node.js versions 16.x through 20.x, consider disabling the use of the deprecated API
process.binding() as a temporary workaround until a patch is available. Restrict access to internal modules to minimize the risk of exploitation. Avoid using process.binding('spawn sync') in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
LPE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Node.Js
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu