Vulnerability · Published Jun 30, 2023 · Assigned by hackerone

CVE-2023-30586

High 7.5

In plain English

A high-severity missing authorization in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.3%top 28.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Affected products (as reported)

Vendor	Product	Versions
NodeJS	Node	4.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.8.0 – before 8.9.0 – before 9.10.0 – before 10.11.0 – before 11.

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In plain English

Official description

Affected products (as reported)

References