PT-2023-9601 · Node.Js · Node.Js

Axel Chong · Published 2023-06-26 · Updated 2025-05-08 · CVE-2023-32004

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Node.js version 20

Description A vulnerability has been discovered in the experimental permission model of Node.js, specifically related to improper handling of Buffers in file system APIs, causing a traversal path to bypass when verifying file permissions. This issue affects all users using the experimental permission model in Node.js 20. The vulnerability can be exploited by specifying a path traversal sequence in a Buffer, allowing an attacker to bypass security restrictions and gain unauthorized access to protected information.

Recommendations For Node.js version 20, consider disabling the experimental permission model until a patch is available. As a temporary workaround, restrict access to file system APIs to minimize the risk of exploitation. Avoid using Buffers with path traversal sequences in file system APIs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-08682

BIT-NODE-2023-32004

BIT-NODE-MIN-2023-32004

CVE-2023-32004

OPENSUSE-SU-2024:13117-1

Affected Products

Node.Js

References · 32

• https://osv.dev/vulnerability/BIT-node-2023-32004 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-min-2023-32004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32004 · Security Note
• https://bdu.fstec.ru/vul/2024-08682 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13117-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32004 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-32004 · Vendor Advisory
• https://github.com/nodejs/node/commit/1f64147eb607f82060e08884f993597774c69280 · Note
• https://t.me/cvenotify/121389 · Telegram Post
• https://suse.com/security/cve/CVE-2023-32558 · Note
• https://twitter.com/CVEnew/status/1691471254702956545 · Twitter Post
• https://t.me/cvenotify/57056 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230915-0009 · Note