Overview
Node is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers an event-driven, non-blocking I/O model that makes it lightweight and efficient, and is widely used in server-side applications.
An Information Exposure vulnerability has been identified in Node. The issue stems from the use of `module.constructor.createRequire()` which can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This weakness allows attackers to require unauthorized modules.
This vulnerability affects specific versions of the package and can result in unauthorized access to modules. Details on affected versions and reproduction steps are provided below.
Details
Module Info
Affected packages: Node
Affected versions: 4.0 < 16.20.2, 18 < 18.17.1, 20 < 20.5.1
GitHub repository: https://github.com/nodejs/node
Published packages: https://github.com/nodejs/node/releases
Package manager: npm
Fixed in: Node.js NES v14
Vulnerability Info
The issue stems from the use of `module.constructor.createRequire()` which can bypass the policy mechanism.
For instance, in a Node.js application, if the policy mechanism is enabled, the system may allow requiring unauthorized modules. This behavior can be exploited by attackers to gain access to sensitive modules.
This vulnerability is a result of flawed logic, and may allow attackers to require unauthorized modules.
- https://www.cve.org/CVERecord?id=CVE-2023-32006
- https://hackerone.com/reports/2043807
Credits
- haxatron1
Mitigation
This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.
- Update to a patched LTS version of Node.js
- Leverage a commercial support partner like HeroDevs for post-EOL security.
Refer to the NES documentation for upgrade instructions.
