Privilege Escalation Vulnerability in Node.js Package - CVE-2023-32559
Summary
UBUNTU-CVE-2023-32559: A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Affects nodejs versions < 12.22.9~dfsg-1ubuntu3.6. Fixed in 12.22.9~dfsg-1ubuntu3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications. The affected version, 12.22.9~dfsg-1ubuntu3.6, is part of the Ubuntu 22.04 LTS ecosystem. This version includes an experimental policy mechanism intended to restrict access to certain internal modules, but it is vulnerable to privilege escalation due to the use of a deprecated API.
Vulnerability Detail
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x, and 20.x. The deprecated API 'process.binding()' can bypass the policy mechanism, allowing attackers to require internal modules and exploit 'process.binding('spawn_sync')' to execute arbitrary code outside the limits defined in a 'policy.json' file. This vulnerability poses significant risks as it can lead to unauthorized access and control over the system.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3.6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the deprecated API 'process.binding()' in your code. Review your application for any instances where this API is called and refactor the code to eliminate its usage.
Conclusion
CVE-2023-32559 is a significant privilege escalation vulnerability in the Node.js package that can lead to unauthorized access and control over systems. It is crucial to update to the patched version to mitigate the risks associated with this vulnerability. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
CVE-2023-32559 is a privilege escalation vulnerability in the Node.js package that allows attackers to bypass security mechanisms and execute arbitrary code.
The vulnerability affects all active release lines of Node.js, specifically versions 16.x, 18.x, and 20.x.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of CVE-2023-32559 is 7.5, indicating a high severity level.
If you cannot update the package immediately, ensure that your application does not use the deprecated API 'process.binding()' as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
