CVE-2022-3358

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers a rich library of various JavaScript modules and is widely used in server-side applications.

A NULL encryption vulnerability (CVE-2022-3358) has been identified in the OpenSSL cryptographic library that Node.js bundles and ships inside its own runtime binary. When code running on an affected Node.js build creates a legacy custom cipher by passing NID_undef to EVP_CIPHER_meth_new() and then hands that cipher to an encryption or decryption initialization function, OpenSSL matches the NULL cipher as an equivalent and fetches it from the loaded providers. The result is that plaintext is emitted as ciphertext, so data the application believes it has encrypted is written or transmitted in the clear.

Per MITRE, CWE-311 (Missing Encryption of Sensitive Data) describes a product that "does not encrypt sensitive or critical information before storage or transmission." Any confidentiality guarantee the calling application relies on is lost, and the failure is silent: the call succeeds and returns data of the expected shape.

This issue affects the Node.js release lines that bundle OpenSSL 3.0.0 through 3.0.5: the entire Node.js 17.x line, Node.js 18.0.0 through 18.12.0, and Node.js 19.0.0. Node.js 16.x and earlier bundle OpenSSL 1.1.1, which is not vulnerable.

Details

Module Info

• Product: Node.js
• Affected packages: node (the Node.js runtime, by way of its bundled OpenSSL dependency in deps/openssl)
• Affected versions: >=17.0.0 <=17.9.1, >=18.0.0 <18.12.1, >=19.0.0 <19.0.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://github.com/nodejs/node/releases
• Package manager: Official Node.js distributions (not published to a package registry)
• Fixed in: NES for Node.js v16.20.3 (July 30, 2024)

Vulnerability Info

This High-severity vulnerability is not in Node.js JavaScript code. It lives in the OpenSSL library that every Node.js release bundles and links statically into the node binary, and it is present in each Node.js build that ships OpenSSL 3.0.0 through 3.0.5. Because that OpenSSL copy is part of the published Node.js runtime rather than something an application installs separately, the exposure travels with the Node.js version in use.

OpenSSL allows an application to define its own cipher through the legacy EVP_CIPHER_meth_new() family of functions. That interface was deprecated in OpenSSL 3.0 in favor of the provider mechanism, but it remains callable. Each custom cipher is identified by a NID, which is meant to be unique to that cipher, and the initialization functions EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() are expected to use the cipher they are given.

In OpenSSL 3.0.0 through 3.0.5 those functions do something different: instead of using the supplied legacy cipher directly, they look up an equivalent cipher from the loaded providers, keyed on the NID passed to EVP_CIPHER_meth_new(). An application that incorrectly passes NID_undef as that value triggers a match against the NULL cipher, which the default provider supplies. The lookup succeeds, the initialization call reports success, and every subsequent update and final call passes the input through unchanged. The plaintext becomes the ciphertext, which is a missing encryption of sensitive data condition rather than a memory-safety fault.

The affected entry points are OpenSSL C APIs. They are not reachable from the JavaScript surface of the Node.js crypto module, which does not register legacy custom ciphers. Practical exposure on Node.js therefore sits with native addons and embedders that link against the OpenSSL symbols in the Node.js binary and call these initialization functions themselves.

NVD scores this issue CVSS v3.1 7.5, High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

The fix reached Node.js users through a dependency upgrade rather than a Node.js-specific patch. OpenSSL corrected the behavior in 3.0.6 on October 11, 2022, and Node.js 18.12.1 and 19.0.1, both released on November 4, 2022, upgraded the bundled library to quictls/openssl-3.0.7+quic. Node.js 17.x reached End-of-Life on June 1, 2022 and never received the corrected library.

Note: NES for Node.js v16.20.3 (July 30, 2024) is the version listed in Fixed In above. It shipped as part of NES's cumulative catch-up on the whole OpenSSL 3.0.x CVE backlog for the Node.js 16.x post-EOL line. The upstream fix date of November 4, 2022 above is when the actually-affected 18.x and 19.x lines received the fix from the Node.js project itself.

Note: Applications that only use SSL/TLS are not impacted by this issue, and only code that calls EVP_CIPHER_meth_new() with NID_undef and then uses the resulting cipher is affected. OpenSSL 1.1.1 and 1.0.2 are not vulnerable, so Node.js release lines up to and including 16.x are outside the scope of this CVE.

Mitigation

The Node.js 17.x, 18.x and 19.x release lines have all reached End-of-Life and will not receive any further updates from the Node.js project. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a Node.js release line that is still supported by the Node.js project.
• Migrate affected applications away from End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Chris Rapier, Pittsburgh Supercomputing Center (reporter)
• Matt Caswell, OpenSSL (remediation developer)