CVE-2023-30581

Description

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.02%• Percentile: 5%

Techniques & Countermeasures

• CWE-862•Missing Authorization

  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

• nodejs•node

  ≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.20.1 | ≥ 17.0, < 17.* | ≥ 18.0, < 18.16.1 | ≥ 19.0, < 19.* | ≥ 20.0, < 20.3.1

• nodejs•node.js

  ≥ 16.0.0, < 16.20.1 | ≥ 18.0.0, < 18.16.1 | ≥ 20.0.0, < 20.3.1

References (2)

• https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
• https://security.netapp.com/advisory/ntap-20241101-0011/