CVE-2023-32559: Permissions policies can be bypassed via process.binding
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawnsync') run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by the use of the deprecated API process.binding(). By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the permission policy mechanism.
— IBM
The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawnsync') run arbitrary code, outside of the limits defined in a policy.json file.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/nodejsto a version that resolves this vulnerability.Fixed in 12.22.9~dfsg-1ubuntu3.6 - Upgrade
Upgrade
ubuntu/nodejsto a version that resolves this vulnerability.Fixed in 18.13.0+dfsg1-1ubuntu2.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.20.2Fixed in 18.17.1Fixed in 20.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.20.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.17.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.5.1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-32559?
CVE-2023-32559 is a privilege escalation vulnerability that exists in the experimental policy mechanism in Node.js.
Which versions of Node.js are affected by CVE-2023-32559?
CVE-2023-32559 affects all active release lines of Node.js: 16.x, 18.x, and 20.x.
How does CVE-2023-32559 work?
CVE-2023-32559 can be exploited by using the deprecated API `process.binding()` to bypass the policy mechanism, allowing privilege escalation.
What is the severity of CVE-2023-32559?
CVE-2023-32559 has a severity rating of 7.5 (high).
How can I fix CVE-2023-32559?
To fix CVE-2023-32559, update your Node.js version to the latest release in the affected release lines: 16.x, 18.x, or 20.x.