CVE-2023-30581

Description

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 1.05%• Percentile: 63%

Techniques & Countermeasures

• CWE-862•Missing Authorization

  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

• chainguard•nodejs-16

  < 16.20.1-r0

• chainguard•nodejs-18

  < 18.16.1-r0

• chainguard•nodejs-20

  < 20.3.1-r0

• wolfi•nodejs-16

  < 16.20.1-r0

• wolfi•nodejs-18

  < 18.16.1-r0

• wolfi•nodejs-20

  < 20.3.1-r0

• debian•nodejs

  all | < 18.19.0+dfsg-6~deb12u1 | < 18.13.0+dfsg1-1.1 | < 18.13.0+dfsg1-1.1

• nodejs•node

  ≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.20.1 | ≥ 17.0, < 17.* | ≥ 18.0, < 18.16.1 | ≥ 19.0, < 19.* | ≥ 20.0, < 20.3.1

• nodejs•node.js

  ≥ 16.0.0, < 16.20.1 | ≥ 18.0.0, < 18.16.1 | ≥ 20.0.0, < 20.3.1

References (5)

• https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
• https://security.netapp.com/advisory/ntap-20241101-0011/
• https://security-tracker.debian.org/tracker/CVE-2023-30581
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30581.json
• https://nvd.nist.gov/vuln/detail/CVE-2023-30581