CVE-2023-32559: High severity langgenius dify node.js vulnerability
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawnsync') run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by the use of the deprecated API process.binding(). By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the permission policy mechanism.
— IBM
The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawnsync') run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Security Advisory: https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-32559?
CVE-2023-32559 is a privilege escalation vulnerability that exists in the experimental policy mechanism in Node.js.
Which versions of Node.js are affected by CVE-2023-32559?
CVE-2023-32559 affects all active release lines of Node.js: 16.x, 18.x, and 20.x.
How does CVE-2023-32559 work?
CVE-2023-32559 can be exploited by using the deprecated API `process.binding()` to bypass the policy mechanism, allowing privilege escalation.
What is the severity of CVE-2023-32559?
CVE-2023-32559 has a severity rating of 7.5 (high).
How can I fix CVE-2023-32559?
To fix CVE-2023-32559, update your Node.js version to the latest release in the affected release lines: 16.x, 18.x, or 20.x.