Overview
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers an event-driven, non-blocking I/O model that makes it lightweight and efficient, and is widely used in web applications and server-side development.
An Execution with Unnecessary Privileges vulnerability has been identified in Node.js. The issue stems from setuid() not affecting libuv's internal io_uring operations if initialized before the call to setuid(). This weakness allows attackers to perform privileged operations despite presumably having dropped such privileges through a call to setuid().
This vulnerability affects specific versions of the package and can result in unauthorized access. Details on affected versions and reproduction steps are provided below.
Details
Module Info
- Affected packages: Node.js
- Affected versions: 4.0 < 20.11.1
- GitHub repository: https://github.com/nodejs/node
- Published packages: https://github.com/nodejs/node/releases
- Package manager: npm
- Fixed in: Node.js NES version 18
Vulnerability Info
The issue stems from improper privilege management.
For instance, in a scenario where a process drops its privileges via setuid(), if the io_uring operations are initialized beforehand, the system may still allow privileged operations. This behavior can be exploited by attackers to escalate privileges.
This vulnerability is a result of flawed logic, and may allow attackers to execute arbitrary code.
- https://hackerone.com/reports/2170226
- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/03-Testing_for_Privilege_Escalation
Mitigation
This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.
- Update to a patched LTS version of Node.js
- Leverage a commercial support partner like HeroDevs for post-EOL security.
Refer to the NES documentation for upgrade instructions.
Credits
- valette
