CVE-2022-32223: DLL Hijacking on Windows
Node.js could allow a local attacker to gain elevated privileges on the system, caused by the DLL search order hijacking of providers.dll. By placing a specially crafted file, an attacker could exploit this vulnerability to escalate privileges.
Other sources
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms. This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.
Whenever the above conditions are present, node.exe will search for providers.dll in the current user directory. After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows.
It is possible for an attacker to place the malicious file providers.dll under a variety of paths and exploit this vulnerability.
— Node.Js
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, node.exe will search for providers.dll in the current user directory.After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file providers.dll under a variety of paths and exploit this vulnerability.
This vulnerability can be exploited if the victim has the following dependencies on Windows machine:
OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.
Whenever the above conditions are present, node.exe will search for providers.dll in the current user directory. After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows.
It is possible for an attacker to place the malicious file providers.dll under a variety of paths and exploit this vulnerability.
More details will be available at CVE-2022-32223 after publication.
All versions of the 16.x, and 14.x releases lines.
Note:
This is a breaking change that has been made to the v14.x, v16.x, and v18.x releases lines.
Node.js can use an OpenSSL configuration file by specifying the environment variable OPENSSLCONF, or using the command line option --openssl-conf, and if none of those are specified will default to reading the default OpenSSL configuration file openssl.cnf. Node.js will only read a section that is by default named nodejsconf.
If your installation was using the default openssl.cnf file and is affected by this breaking change you can fall back to the previous behavior by:
Adding --openssl-shared-config to the command line (Node.js 18.5.0 only); or
Creating a new nodejsconf section in that file and copying the contents of the default section into the new nodejsconf section.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.20.0Fixed in 16.20.0Fixed in 18.5.0 - Configuration
If using the default openssl.cnf and affected by the breaking change, create a new nodejs_conf section in the file and copy the default section contents into it. For Node.js 18.5.0, alternatively add --openssl-shared-config to the command line.
Node.js/OpenSSL nodejs_conf / --openssl-shared-config = Create a nodejs_conf section containing the contents of the default section; for Node.js 18.5.0, add --openssl-shared-config to the command line
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-32223?
CVE-2022-32223 is a vulnerability in Node.js that allows hijacking the execution flow through DLL hijacking on Windows platforms.
What is the severity of CVE-2022-32223?
The severity of CVE-2022-32223 is high, with a CVSS score of 7.3.
How can CVE-2022-32223 be exploited?
CVE-2022-32223 can be exploited if the victim has specific dependencies on a Windows machine, including having OpenSSL installed and a particular file path present.
Which versions of Node.js are affected by CVE-2022-32223?
Node.js versions 14.0.0 to 14.14.0 (inclusive), versions 14.14.0 to 14.20.0 (exclusive) with LTS tag, versions 16.0.0 to 16.12.0 (inclusive), versions 16.13.0 to 16.16.0 (exclusive) with LTS tag, and versions 18.0.0 to 18.0.5 (exclusive) are affected by CVE-2022-32223.
How do I fix CVE-2022-32223?
Users should upgrade their Node.js installations to the patched versions mentioned in the security advisories.