Node.js v20 Permission Model Flaw: fs.watchFile Enables Unauthorized Monitoring
CVE-2023-30582 Published on September 7, 2024
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Vulnerability Analysis
CVE-2023-30582 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2023-30582 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2023-30582
Want to know whenever a new CVE is published for nodejs node.js? stack.watch will email you.
Affected Versions
NodeJS Node:- Version 4.0 and below 4.* is affected.
- Version 5.0 and below 5.* is affected.
- Version 6.0 and below 6.* is affected.
- Version 7.0 and below 7.* is affected.
- Version 8.0 and below 8.* is affected.
- Version 9.0 and below 9.* is affected.
- Version 10.0 and below 10.* is affected.
- Version 11.0 and below 11.* is affected.
- Version 12.0 and below 12.* is affected.
- Version 13.0 and below 13.* is affected.
- Version 14.0 and below 14.* is affected.
- Version 15.0 and below 15.* is affected.
- Version 17.0 and below 17.* is affected.
- Version 19.0 and below 19.* is affected.
- Version 20.0 and below 20.3.1 is affected.
- Version 20.0 and below 20.3.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.