CVE-2022-32223
📋 TL;DR
Node.js on Windows is vulnerable to DLL hijacking when OpenSSL is installed with a specific configuration file path. This allows attackers to execute arbitrary code by placing a malicious providers.dll file in directories where Node.js searches. Only Windows users with OpenSSL installed in the default location are affected.
💻 Affected Systems
- Node.js
📦 What is this software?
Node.js by Nodejs
Node.js by Nodejs
Node.js by Nodejs
Node.js by Nodejs
Node.js by Nodejs
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the Node.js process, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the Node.js application, allowing attackers to steal credentials, manipulate application data, or pivot to other systems.
If Mitigated
No impact if proper file permissions prevent DLL placement in vulnerable directories or if OpenSSL is not installed in the default location.
🎯 Exploit Status
Exploitation requires ability to place DLL in specific directories, typically requiring some level of local access or file write permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Node.js 16.16.0, 18.5.0, or 14.20.0
Vendor Advisory: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
Restart Required: Yes
Instructions:
1. Identify current Node.js version using 'node --version'. 2. Upgrade to Node.js 16.16.0, 18.5.0, or 14.20.0 or later. 3. Restart all Node.js applications and services.
🔧 Temporary Workarounds
Remove vulnerable OpenSSL configuration
windowsDelete or rename the openssl.cnf file at C:\Program Files\Common Files\SSL\openssl.cnf
del "C:\Program Files\Common Files\SSL\openssl.cnf"
Restrict DLL search paths
windowsUse Windows policies or application controls to restrict where Node.js can load DLLs from
🧯 If You Can't Patch
- Implement strict file permissions on user directories and system paths to prevent DLL placement
- Monitor for creation of providers.dll files in unusual locations using file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check if openssl.cnf exists at C:\Program Files\Common Files\SSL\ and Node.js version is below 16.16.0, 18.5.0, or 14.20.0Check Version:
node --versionVerify Fix Applied:
Verify Node.js version is 16.16.0, 18.5.0, 14.20.0 or higher using 'node --version'📡 Detection & Monitoring
Log Indicators:
- Failed DLL loading attempts from unusual paths
- Process creation events showing Node.exe loading providers.dll
Network Indicators:
- Unusual outbound connections from Node.js processes post-DLL load
SIEM Query:
Process Creation where Image contains 'node.exe' and CommandLine contains 'providers.dll' OR File Creation where TargetFilename contains 'providers.dll'🔗 References
- https://hackerone.com/reports/1447455
- https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
- https://security.netapp.com/advisory/ntap-20220915-0001/
- https://hackerone.com/reports/1447455
- https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
- https://security.netapp.com/advisory/ntap-20220915-0001/
