Overview
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers a rich library of various JavaScript modules and is widely used in server-side applications.
An Signature Forgery vulnerability has been identified in Node.js. The issue stems from the application intercepting the integrity check operation and returning a forged checksum. This weakness allows attackers to effectively disable the integrity check.
This vulnerability affects specific versions of the package and can result in unauthorized access. Details on affected versions and reproduction steps are provided below.
Details
Module Info
Affected packages: Node
Affected versions: 4.0 <= 18.18.1, 20 < 20.8.1
GitHub repository: https://github.com/nodejs/node
Published packages: https://github.com/nodejs/node/releases
Package manager: npm
Fixed in: Node.js NES version 16.
Vulnerability Info
The issue stems from the application being able to intercept the integrity check operation.
For instance, in the context of using the Node.js policy feature, if an application intercepts the operation, the system can return a forged checksum. This behavior can be exploited by attackers to disable integrity checks.
This vulnerability is a result of flawed logic, and may allow attackers to bypass security mechanisms.
- https://www.cve.org/CVERecord?id=CVE-2023-38552
- https://hackerone.com/reports/2094235
Credits
- tniessen
Mitigation
This vulnerability is not fixed upstream due to the policy mechanism being an experimental feature. Herodevs has issued patched builds under the NES (Never Ending Support) line.
- Update to a patched LTS version of Node.js
- Leverage a commercial support partner like HeroDevs for post-EOL security.
Refer to the NES documentation for upgrade instructions.
