CVE-2023-39532

Summary

CVE-2023-39532 is a vulnerability affecting the SES JavaScript environment in various versions prior to 0.18.7, 0.17.1, 0.16.1, 0.15.24, 0.14.5, and 0.13.5. This issue involves a bypass of the confinement system in SES, enabling guest applications to access the surrounding host's dynamic import functionality. This vulnerability can lead to exfiltration of information or execution of arbitrary code, depending on the host's configuration. In web environments, a properly set Content-Security-Policy can help mitigate this risk. However, without such a policy, an attacker can use dynamic import to issue HTTP requests and potentially execute code. Within Node.js, the attacker gains access to Node.js's module system, allowing them to import data URLs and execute arbitrary code. Patches for this vulnerability have been released in versions 0.18.7, 0.17.1, 0.16.1, 0.15.24, 0.14.5, and 0.13.5. Workarounds include implementing a Content-Security-Policy in web environments and building a binary without the ability to load modules at runtime in other contexts.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.