Vulnerability

CERT-In Vulnerability Note CIVN-2023-0312
Multiple Vulnerabilities in Node.js

Original Issue Date:October 19, 2023

Severity Rating: HIGH

Software Affected

Node.js versions prior to 18.18.2 (LTS)
Node.js versions prior to 20.8.1

Overview

Multiple vulnerabilities have been reported in Node.js, which could allow a remote attacker to cause denial of service, disclose sensitive information and bypass security restrictions on the targeted system.

Description

1. Security Bypass Vulnerability ( CVE-2023-38552   )

This vulnerability exists in Node.js due to an issue in the policy feature. A remote attacker could exploit this vulnerability by sending a specially-crafted request to bypass the policy mechanism.
Successful exploitation of this vulnerability could allow a remote attacker to bypass security restriction on the targeted system.

2. Remote code Execution Vulnerability ( CVE-2023-39333   )

This vulnerability exists in Node.js due to improper input validation in an imported Web Assembly module when processing export names. A remote attacker could exploit this vulnerability by sending a specially-crafted request to execute arbitrary JavaScript code on the system.
Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the targeted system.

3. Path Traversal Vulnerability ( CVE-2023-39331   CVE-2023-39332   )

These vulnerabilities exist in Node.js due to input validation error when processing directory traversal sequences in paths stored in Uint8Array and insufficient patch. A remote attacker could exploit these vulnerabilities by sending a specially-crafted HTTP request and read arbitrary files on the system.
Successful exploitation of these vulnerabilities could allow a remote attacker to perform directory traversal attacks on the targeted system.

4. Information Disclosure Vulnerability ( CVE-2023-45143   )

This vulnerability exists in Node.js due to unclear Cookies headers in cross origin redirects. A remote attacker could exploit this vulnerability and gain unauthorized access to sensitive information on the targeted system.
Successful exploitation of this vulnerability could allow a remote attacker to gain access to potentially sensitive information on the targeted system.

5. Denial of Service Vulnerability ( CVE-2023-44487   )

This vulnerability exists in Node.js due to improper control of consumption for internal resources when handling HTTP/2 requests. A remote attacker could exploit this vulnerability by sending a specially-crafted request.
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial of service condition on the targeted system.

Note: CVE-2023-44487 is a denial-of-service (DoS) vulnerability. The vulnerability has been exploited in the wild.

Solution

Apply appropriate updates as mentioned
https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

Vendor Information

Node.js
https://nodejs.org/en/blog/vulnerability/october-2023-security-releases

CVE Name
CVE-2023-38552
CVE-2023-39333
CVE-2023-39331
CVE-2023-39332
CVE-2023-45143
CVE-2023-44487

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India