CVE-2023-39332: Path Traversal
Node.js could allow a remote attacker to bypass security restrictions, caused by a path traversal bypass using non-Buffer Uint8Array objects. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass the experimental permission model.
Other sources
Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.
This is distinct from CVE-2023-32004 (report 2038134), which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.
Impacts:
This vulnerability affects all users using the experimental permission model in Node.js 20.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects. This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.
References: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not enable or disable usage of the Node.js experimental permission model; disable or stop using the experimental permission model (users running Node.js 20 with the experimental permission model should stop using it) until an official security fix is available.
Node.js (experimental permission model) experimental permission model enabled = false - Configuration
Ensure all path arguments passed to node:fs functions are normalized to strings or Buffer objects; convert or reject non-Buffer Uint8Array inputs to prevent path traversal via non-Buffer Uint8Array objects.
Application code using node:fs path input type = string or Buffer only - Compensating control
Apply OS-level or environment controls (least-privilege file system permissions, chroot/containers, or similar isolation) to limit filesystem access for Node.js processes and avoid relying solely on the experimental Node.js permission model as a security boundary.
- Operational
Audit code and dependencies for uses of node:fs functions that accept Uint8Array paths and identify places where untrusted input could be supplied as a non-Buffer Uint8Array; update the code to validate and normalize path inputs (convert to string or Buffer) and add path traversal checks.
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-39332.
What functions are affected by this vulnerability?
Various `node:fs` functions are affected by this vulnerability.
What software is affected by this vulnerability?
Node.js versions up to 20.8.0 are affected by this vulnerability.
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is critical with a rating of 9.8.
Are there any references for this vulnerability?
Yes, you can find references for this vulnerability at the following links: [Link 1](https://hackerone.com/reports/2199818), [Link 2](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/), [Link 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/).
What is the Common Weakness Enumeration (CWE) ID associated with this vulnerability?
The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-22.