CVE-2023-30586: OpenSSL engines can be used to bypass the permission model
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Other sources
Node.js 20 allows loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model.
— Node.Js
Node.js could allow a remote attacker to bypass security restrictions, caused by an error in the crypto.setEngine() API when called with a compatible OpenSSL engine. By manipulating the process's stack memory to locate the permission model Permission::enabled in the host process's heap memory, an attacker could exploit this vulnerability to bypass the permission model.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-30586?
CVE-2023-30586 is a privilege escalation vulnerability in Node.js 20 that allows loading arbitrary OpenSSL engines and bypasses the permission model when the experimental permission model is enabled.
What is the severity of CVE-2023-30586?
The severity of CVE-2023-30586 is high, with a severity value of 7.5.
Which version of Node.js is affected by CVE-2023-30586?
Node.js version 20.0.0 is affected by CVE-2023-30586.
How can CVE-2023-30586 be exploited?
CVE-2023-30586 can be exploited by using the crypto.setEngine() API to bypass the permission model.
Are there any references related to CVE-2023-30586?
Yes, you can find more information about CVE-2023-30586 in the following references: - [HackerOne report](https://hackerone.com/reports/1954535) - [NetApp advisory](https://security.netapp.com/advisory/ntap-20230803-0008/)