Rewterz Threat Advisory – Multiple Node.js Vulnerabilities

Severity

High

Analysis Summary

CVE-2022-25883 CVSS:5.3

Node.js semver package is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the new Range function. By providing specially crafted regex input, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2023-30590 CVSS:5.3

Node.js could provide weaker than expected security, caused by the failure to generate keys after setting a private key by the generateKeys() API function. By sending a specially crafted request, an attacker could exploit this vulnerability to launch further attacks on the system.

CVE-2023-30589 CVSS:5.9

Node.js is vulnerable to HTTP request smuggling, caused by the failure to strictly use the CRLF sequence to delimit HTTP requests by the llhttp parser in the http module. By sending specially crafted HTTP request headers, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

CVE-2023-30588 CVSS:5.3

Node.js is vulnerable to a denial of service, caused by invalid public key information in x509 certificates. By accessing public key info of provided certificates from user code, an attacker could exploit this vulnerability to force interruptions of application processing and cause a denial of service.

CVE-2023-30586 CVSS:5.3

Node.js could allow a remote attacker to bypass security restrictions, caused by an error in the crypto.setEngine() API when called with a compatible OpenSSL engine. By manipulating the process’s stack memory to locate the permission model Permission::enabled_ in the host process’s heap memory, an attacker could exploit this vulnerability to bypass the permission model.

CVE-2023-30585 CVSS:5.9

Node.js could allow a remote attacker to gain elevated privileges on the system, caused by an error in the installation process during the repair operation, where the “msiexec.exe” process attempts to read the %USERPROFILE% environment variable from the current user’s registry. An attacker could exploit this vulnerability to create folders in unintended and potentially malicious locations.

CVE-2023-30583 CVSS:5.3

Node.js could allow a remote attacker to bypass security restrictions, caused by a missing check in the fs.openAsBlob() API. By using the file system read restriction with the –allow-fs-read flag, an attacker could exploit this vulnerability to bypass the experimental permission model.

CVE-2023-30582 CVSS:5.3

Node.js could allow a remote attacker to bypass security restrictions, caused by the failure to restrict file watching through the fs.watchFile API. By sending a specially crafted request, an attacker could exploit this vulnerability to monitor restricted files.

CVE-2023-30587 CVSS:7.5

Node.js could allow a remote attacker to bypass security restrictions. By exploiting the Worker class’s ability to create an “internal worker” with the kIsInternal Symbol, an attacker could exploit this vulnerability to modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl.

CVE-2023-30584 CVSS:7.5

Node.js could allow a remote attacker to bypass security restrictions, caused by a path traversal bypass when verifying file permissions. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the experimental permission model.

CVE-2023-30581 CVSS:7.5

Node.js could allow a remote attacker to bypass security restrictions, caused by the use of proto in process.mainModule.proto.require(). By sending a specially crafted request, an attacker could exploit this vulnerability to bypass experimental policy mechanism.

Impact

• Gain Access
• Privilege Escalation
• Denial of Service
• Security Bypass

Indicators Of Compromise

CVE

• CVE-2022-25883
• CVE-2023-30590
• CVE-2023-30589
• CVE-2023-30588
• CVE-2023-30586
• CVE-2023-30585
• CVE-2023-30583
• CVE-2023-30582
• CVE-2023-30587
• CVE-2023-30584
• CVE-2023-30581

Affected Vendors

Node.js

Affected Products

• Node.js semver 7.5.1
• Node.js semver 7.5.0
• Node.js semver 7.4.0
• Node.js 16.0
• Node.js 18.0
• Node.js 20.0

Remediation

Refer to NPM Web Site and Node.js Security Advisory for patch, upgrade or suggested workaround information.

NPM Web site

Node.js Security Advisory