CVE-2023-39333: Code Injection
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.
References: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases
Other sources
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.
This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.
— NVD
Node.js could allow a remote attacker to gain unauthorized access to the system, caused by a code injection flaw. By using specially crafted export names in an imported WebAssembly module, an attacker could exploit this vulnerability to inject JavaScript code and gain access to restricted data and functions.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure Node.js is not started with the --experimental-wasm-modules command-line option. Remove the flag from any startup scripts, systemd unit files, container entrypoints, or orchestration configs and restart Node.js without this option.
Node.js --experimental-wasm-modules = disabled - Compensating control
Prevent untrusted or external WebAssembly modules from being imported. Restrict network exposure and access to services that accept uploaded/imported WASM modules using firewalls, WAFs, or ACLs; validate or block WASM module uploads from untrusted sources.
- Operational
Inventory running Node.js instances and processes to detect any started with --experimental-wasm-modules. If present, restart those instances without the flag. Review logs and audit for signs of suspicious activity or unauthorized access associated with WASM module imports and investigate any anomalies.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-39333?
CVE-2023-39333 has been classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-39333?
To fix CVE-2023-39333, apply the available patches provided by IBM for affected versions of Cognos Analytics.
Which versions of IBM Cognos Analytics are affected by CVE-2023-39333?
CVE-2023-39333 affects IBM Cognos Analytics versions up to 12.0.2 and 11.2.4 FP3.
What is the nature of the vulnerability in CVE-2023-39333?
CVE-2023-39333 allows maliciously crafted WebAssembly exports to inject JavaScript code into the application.
Can CVE-2023-39333 lead to data breaches?
Yes, CVE-2023-39333 could potentially lead to data breaches by allowing unauthorized access to sensitive data and functions.