CVE-2023-32002 HackerOne: CVE-2023-32002 Node.js `Module._load()` policy Remote Code Execution Vulnerability
CriticalCVSS 9.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft visual studio 2019 | < 16.11.44 | 16.11.44 |
| Microsoft cbl mariner | < 16.20.2-2 | 16.20.2-2 |
| Microsoft cbl mariner | < 18.17.1-2 | 18.17.1-2 |
| debian/nodejs(Debian:12) | < 18.19.0+dfsg-6~deb12u1 | 18.19.0+dfsg-6~deb12u1 |
| debian/nodejs(Debian:12) | = 18.13.0+dfsg1-1 | No fix listed |
| debian/nodejs(Debian:12) | = 18.13.0+dfsg1-1.1 | No fix listed |
| debian/nodejs(Debian:12) | = 18.19.0+dfsg-1 | No fix listed |
| debian/nodejs(Debian:12) | = 18.19.0+dfsg-2 | No fix listed |
| debian/nodejs(Debian:12) | = 18.19.0+dfsg-3 | No fix listed |
| debian/nodejs(Debian:12) | = 18.19.0+dfsg-4 | No fix listed |
| debian/nodejs(Debian:12) | = 18.19.0+dfsg-5 | No fix listed |
| debian/nodejs(Debian:13) | < 18.13.0+dfsg1-1.1 | 18.13.0+dfsg1-1.1 |
| debian/nodejs(Debian:14) | < 18.13.0+dfsg1-1.1 | 18.13.0+dfsg1-1.1 |
| nodejs node | >= 4.0 | No fix listed |
| nodejs node | >= 5.0 | No fix listed |
| nodejs node | >= 6.0 | No fix listed |
| nodejs node | >= 7.0 | No fix listed |
| nodejs node | >= 8.0 | No fix listed |
| nodejs node | >= 9.0 | No fix listed |
| nodejs node | >= 10.0 | No fix listed |
| nodejs node | >= 11.0 | No fix listed |
| nodejs node | >= 12.0 | No fix listed |
| nodejs node | >= 13.0 | No fix listed |
| nodejs node | >= 14.0 | No fix listed |
| nodejs node | >= 15.0 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node | >= 16.0, < 16.20.2 | 16.20.2 |
| nodejs node | >= 17.0 | No fix listed |
| nodejs node | >= 18.0, < 18.17.1 | 18.17.1 |
| nodejs node | >= 19.0 | No fix listed |
| nodejs node | >= 20.0, < 20.5.1 | 20.5.1 |
| nodejs | <= 16.20.1 | No fix listed |
| nodejs | <= 18.17.0 | No fix listed |
| nodejs | <= 20.5.0 | No fix listed |
| ubuntu/nodejs(Ubuntu:22.04) | < 12.22.9~dfsg-1ubuntu3.6 | 12.22.9~dfsg-1ubuntu3.6 |
| alpine/nodejs(Alpine:v3.15) | < 16.20.2-r0 | 16.20.2-r0 |
| alpine/nodejs(Alpine:v3.16) | < 16.20.2-r0 | 16.20.2-r0 |
| alpine/nodejs(Alpine:v3.17) | < 18.17.1-r0 | 18.17.1-r0 |
| alpine/nodejs(Alpine:v3.18) | < 18.17.1-r0 | 18.17.1-r0 |
| alpine/nodejs(Alpine:v3.19) | < 18.17.1-r0 | 18.17.1-r0 |
| alpine/nodejs(Alpine:v3.20) | < 18.17.1-r0 | 18.17.1-r0 |
| alpine/nodejs(Alpine:v3.21) | < 18.17.1-r0 | 18.17.1-r0 |
| alpine/nodejs(Alpine:v3.22) | < 18.17.1-r0 | 18.17.1-r0 |
| alpine/nodejs(Alpine:v3.23) | < 18.17.1-r0 | 18.17.1-r0 |
| alpine/nodejs(Alpine:v3.24) | < 18.17.1-r0 | 18.17.1-r0 |
| nodejs node.js | >= 16.0.0, <= 16.20.1 | No fix listed |
| nodejs node.js | >= 18.0.0, <= 18.17.0 | No fix listed |
| nodejs node.js | >= 20.0.0, <= 20.5.0 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- nodejs vendor-advisory
- Debian Security Tracker CVE-2023-32002 vendor-advisory
- hackerone.com third-party-advisory
- security.netapp.com
- Ubuntu CVE tracker vendor-advisory
- USN-6822-1 vendor-advisory
- www.cve.org
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking