A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
References
| Link | Resource |
|---|---|
| https://hackerone.com/reports/1954535 | Issue Tracking Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230803-0008/ | Third Party Advisory |
Configurations
History
17 Nov 2023, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | |
| References | (MISC) https://security.netapp.com/advisory/ntap-20230803-0008/ - Third Party Advisory | |
| References | (MISC) https://hackerone.com/reports/1954535 - Issue Tracking, Third Party Advisory |
03 Aug 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Jul 2023, 14:01
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-862 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | (MISC) https://hackerone.com/reports/1954535 - Issue Tracking | |
| First Time |
Nodejs
Nodejs node.js |
|
| CPE | cpe:2.3:a:nodejs:node.js:20.0.0:*:*:*:-:*:*:* |
01 Jul 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-01 00:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-30586
Mitre link : CVE-2023-30586
CVE.ORG link : CVE-2023-30586
JSON object : View
Products Affected
nodejs
- node.js
CWE
CWE-862
Missing Authorization