Privilege Escalation Vulnerability in Node.js Package - CVE-2023-23918
Summary
UBUNTU-CVE-2023-23918: A privilege escalation vulnerability exists in Node.js. Affects nodejs versions < 18.19.1+dfsg-2ubuntu4. Fixed in 18.19.1+dfsg-2ubuntu4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected version, 18.19.1+dfsg-2ubuntu4, includes a feature for experimental permissions that, if enabled, can be exploited to bypass security measures.
Vulnerability Detail
A privilege escalation vulnerability exists in Node.js versions below 19.6.1, 18.14.1, 16.19.1, and 14.21.3. This vulnerability allows unauthorized access to modules by bypassing the experimental Permissions feature using process.mainModule.require(). It primarily affects users who have enabled the experimental permissions option with --experimental-policy, potentially leading to unauthorized access to sensitive modules.
How To Fix
Minimum fixed version
18.19.1+dfsg-2ubuntu4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package immediately, consider disabling the experimental permissions feature by not using the --experimental-policy flag when starting your Node.js application.
Conclusion
CVE-2023-23918 presents a significant risk for users of Node.js who have enabled experimental permissions. It is crucial to update to the patched version to mitigate this vulnerability and ensure the security of your applications.
See every vulnerability recorded for nodejs →
FAQ
CVE-2023-23918 is a privilege escalation vulnerability in Node.js that allows unauthorized access to modules.
Node.js versions below 19.6.1, 18.14.1, 16.19.1, and 14.21.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive modules, which may compromise the security of your application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
