CVE-2023-30582: fs.watchFile bypass in experimental permission model
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument.
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by the failure to restrict file watching through the fs.watchFile API. By sending a specially crafted request, an attacker could exploit this vulnerability to monitor restricted files.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-30582?
The severity of CVE-2023-30582 is classified as high due to the potential for unauthorized file access.
How do I fix CVE-2023-30582?
To fix CVE-2023-30582, users should avoid using the --allow-fs-read flag with non-* arguments or upgrade to a secure version of Node.js.
Which versions of Node.js are affected by CVE-2023-30582?
CVE-2023-30582 affects Node.js version 20 that utilizes the experimental permission model.
What is the impact of CVE-2023-30582?
The impact of CVE-2023-30582 allows unauthorized access to file watching capabilities, compromising system security.
Is IBM Planning Analytics affected by CVE-2023-30582?
Yes, IBM Planning Analytics version 2.0 and below are affected by CVE-2023-30582 if using vulnerable Node.js setups.