Node.js: fs.statfs bypasses Permission Model

🗓️ 05 Jul 2023 15:16:06Reported by rafaelgssType

hackerone

hackerone🔗 hackerone.com👁 40 Views

`Node.js fs.statfs bypasses permission model, allowing access to restricted paths and retrieving file stats

Reporter	Title	Published	Views	Family All 61
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 9.0.1	16 Nov 202315:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple Node.js vulnerabilities	31 Jan 202413:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor	26 Sep 202308:26	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.11 addresses multiple security vulnerabilities.	20 Dec 202316:10	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to bypassing security restrictions due to multiple Node.js vulnerabilities	14 Sep 202317:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	2 Oct 202320:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.13 and earlier	12 Oct 202319:11	–	ibm
Circl	CVE-2023-32005	14 Nov 202412:00	–	circl
CNNVD	Node.js Security Vulnerabilities	9 Aug 202300:00	–	cnnvd
CVE	CVE-2023-32005	12 Sep 202301:36	–	cve

10 Sep 2023 15:26Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3

EPSS0.00978

SSVC

node.js fs.statfs permission model restricted paths file stats bugbounty