CVE-2023-39332
📋 TL;DR
This vulnerability allows path traversal attacks in Node.js when using non-Buffer Uint8Array objects with fs module functions. Attackers can potentially access files outside intended directories. It affects Node.js applications using the experimental permission model with Uint8Array path inputs.
💻 Affected Systems
- Node.js
📦 What is this software?
Fedora by Fedoraproject
Node.js by Nodejs
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file read/write leading to remote code execution, data exfiltration, or privilege escalation.
Likely Case
Unauthorized file access allowing reading of sensitive configuration files, source code, or credentials stored on the server.
If Mitigated
Limited impact due to proper input validation, sandboxing, or if the experimental permission model is not enabled.
🎯 Exploit Status
Exploitation requires the application to accept Uint8Array path inputs and have the permission model enabled. The vulnerability pattern is similar to previously patched Buffer-based path traversal issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Node.js 20.8.0, Node.js 18.18.1
Vendor Advisory: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases
Restart Required: Yes
Instructions:
1. Update Node.js to version 20.8.0 or 18.18.1 or later. 2. Restart all Node.js applications and services. 3. Verify the update with 'node --version'.
🔧 Temporary Workarounds
Disable permission model
allDisable the experimental permission model if not required
Remove --experimental-permission flag from startup commands
Input validation
allValidate all path inputs to ensure they are strings or Buffer objects only
🧯 If You Can't Patch
- Implement strict input validation to reject Uint8Array path inputs
- Use application-level path sanitization and restrict file system access
🔍 How to Verify
Check if Vulnerable:
Check if Node.js version is below 20.8.0 (for v20) or below 18.18.1 (for v18) and the application uses Uint8Array paths with fs module functions.Check Version:
node --versionVerify Fix Applied:
Confirm Node.js version is 20.8.0+ or 18.18.1+ and test that Uint8Array path inputs are properly validated.📡 Detection & Monitoring
Log Indicators:
- Unexpected file access patterns
- Permission model errors with Uint8Array paths
- Failed path resolution attempts
Network Indicators:
- Unusual file read patterns from application endpoints
SIEM Query:
Search for Node.js permission model errors or unexpected fs module access patterns🔗 References
- https://hackerone.com/reports/2199818
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
- https://security.netapp.com/advisory/ntap-20231116-0009/
- https://hackerone.com/reports/2199818
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
- https://security.netapp.com/advisory/ntap-20231116-0009/
- https://security.netapp.com/advisory/ntap-20241108-0002/
