DLL Hijacking Vulnerability in Node.js: CVE-2022-32223
Summary
UBUNTU-CVE-2022-32223: Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL... Affects nodejs versions < 0.10.25~dfsg2-2ubuntu1.2+esm1. Fixed in 0.10.25~dfsg2-2ubuntu1.2+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected versions of Node.js are vulnerable to a DLL hijacking issue, which can lead to unauthorized code execution on Windows platforms under specific conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2022-32223, arises from Node.js's handling of DLL files on Windows systems. If OpenSSL is installed and a specific configuration file exists, Node.js may search for a malicious DLL named 'providers.dll' in the current user directory. This behavior can be exploited by an attacker to execute arbitrary code, potentially compromising the system's integrity and confidentiality.
How To Fix
Minimum fixed version
0.10.25~dfsg2-2ubuntu1.2+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can ensure that the 'providers.dll' file is not present in the current user directory or any directory that Node.js may search. Additionally, users can avoid using OpenSSL configurations that may trigger this vulnerability.
Conclusion
CVE-2022-32223 is a significant vulnerability affecting multiple versions of Node.js, particularly on Windows platforms. Users are strongly advised to update their installations to the patched versions to mitigate the risk of exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for nodejs →
FAQ
CVE-2022-32223 is a vulnerability in Node.js that allows for DLL hijacking on Windows systems, potentially leading to unauthorized code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access and execution of malicious code, compromising the security of the affected system.
Yes, patched versions of Node.js are available for various Ubuntu distributions. Users should update to the latest versions as specified in the 'how_to_fix' section.
The CVSS score for CVE-2022-32223 is 7.3, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
