A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
References
| Link | Resource |
|---|---|
| https://hackerone.com/reports/1954535 | Issue Tracking Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230803-0008/ | Third Party Advisory |
| https://hackerone.com/reports/1954535 | Issue Tracking Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20230803-0008/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 08:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://hackerone.com/reports/1954535 - Issue Tracking, Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20230803-0008/ - Third Party Advisory |
17 Nov 2023, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | |
| References | (MISC) https://hackerone.com/reports/1954535 - Issue Tracking, Third Party Advisory | |
| References | (MISC) https://security.netapp.com/advisory/ntap-20230803-0008/ - Third Party Advisory |
Information
Published : 2023-07-01 00:15
Updated : 2025-05-08 17:16
NVD link : CVE-2023-30586
Mitre link : CVE-2023-30586
CVE.ORG link : CVE-2023-30586
JSON object : View
Products Affected
nodejs
- node.js
CWE
CWE-862
Missing Authorization