CVE-2023-32559

2023-08-2400:00:00

ubuntu.com

cve-2023-32559

privilege escalation

policy mechanism

deprecated api

internal modules

arbitrary code

policy.json

node.js

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

19.3%

JSON

A privilege escalation vulnerability exists in the experimental policy
mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the
deprecated API process.binding() can bypass the policy mechanism by
requiring internal modules and eventually take advantage of
process.binding('spawn_sync') run arbitrary code, outside of the limits
defined in a policy.json file. Please note that at the time this CVE was
issued, the policy is an experimental feature of Node.js.

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchnodejs< 12.22.9~dfsg-1ubuntu3.6UNKNOWN
ubuntu23.10noarchnodejs< 18.13.0+dfsg1-1ubuntu2.3UNKNOWN