CVE-2023-30586
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-30586 is a privilege escalation vulnerability affecting Node.js version 20. It enables the loading of arbitrary OpenSSL engines when the experimental permission model is activated, bypassing or disabling the model. The attack complexity is high, and an attacker can exploit this vulnerability by manipulating the process's stack memory to locate the permission model's enabled state in the host process's heap memory. The crypto.setEngine() API can be used to execute this attack, allowing the attacker to bypass the Node.js permission model entirely. Note that the permission model is an experimental feature in Node.js at the time this CVE was issued.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions