A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

The version of Siemens SINEC NMS installed on the remote host is prior to 2.0.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA-943925 advisory.

  - coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type     request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload,     aka Content-Type confusion between the WAF and the backend application. This occurs when the web     application relies on only the last Content-Type header. Other platforms may reject the additional     Content-Type header or merge conflicting headers, leading to detection as a malformed header.
    (CVE-2023-38199)

  - Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request     Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of     RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied     request-target (URL) data and is then re-inserted into the proxied request-target using variable     substitution. For example, something like: RewriteEngine on RewriteRule ^/here/(.*)     http://example.com:8080/elsewhere?$1; [P] ProxyPassReverse /here/ http://example.com:8080/ Request     splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended     URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version     2.4.56 of Apache HTTP Server. (CVE-2023-25690)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-18476abd7e advisory.

    https://nodejs.org/en/blog/vulnerability/august-2023-security-releases

    Security releases available     Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues.

    Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002)     The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module.

    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.
    Thank you, to mattaustin for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias     for fixing it.

    Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004)     A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission     model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to     bypass when verifying file permissions.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental permission model in Node.js 20.
    Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it.

    process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558)     The use of the deprecated API process.binding() can bypass the permission model through path traversal.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental permission model in Node.js 20.
    Thank you to Rafael Gonzaga for reporting and fixing this vulnerability.

    Permissions policies can impersonate other modules in using module.constructor.createRequire()     (MEDIUM)(CVE-2023-32006)     The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside     of the policy.json definition for a given module.

    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.
    Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias     for fixing it.

    Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559)     The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal     modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the     limits defined in a policy.json file.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    Impacts

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.
    Thank you, to LeoDog896 for reporting this vulnerability and thank you Tobias Nieen for fixing it.

    fs.statfs can retrive stats from files restricted by the Permission Model (LOW)(CVE-2023-32005)     A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission     model when the --allow-fs-read flag is used with a non-* argument.

    This flaw arises from an inadequate permission model that fails to restrict file stats through the     fs.statfs API. As a result, malicious actors can retrieve stats from files that they do not have explicit     read access to.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental permission model in Node.js 20.
    Thank you to Rafael Gonzaga for reporting and fixing this vulnerability.

    fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003)     fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal     attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor     could create an arbitrary directory.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental permission model in Node.js 20.
    Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it.

    Downloads and release details     Node.js v16.20.2 (LTS)     Node.js v18.17.1 (LTS)     Node.js v20.5.1 (Current)     (Update 08-Aug-2023) Security Release target August 9th     The Node.js Security Releases will be available on, or shortly after, Wednesday, August 9th, 2023.

    Summary     The Node.js project will release new versions of the 16.x, 18.x and 20.x releases lines on or shortly     after, Tuesday August 8th 2023 in order to address:

    3 high severity issues.
    2 medium severity issues.
    2 low severity issues.
    OpenSSL Security updates     This security release includes the following OpenSSL security updates

    OpenSSL security advisory 14th July.
    OpenSSL security advisory 19th July.
    OpenSSL security advisory 31st July.
    Impact     The 20.x release line of Node.js is vulnerable to 3 high severity issues, 2 medium severity issues, and 2     low severity issues.

    The 18.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues.

    The 16.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-d12a917ab4 advisory.

    https://nodejs.org/en/blog/vulnerability/august-2023-security-releases

    Security releases available     Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues.

    Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002)     The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module.

    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.
    Thank you, to mattaustin for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias     for fixing it.

    Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004)     A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission     model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to     bypass when verifying file permissions.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental permission model in Node.js 20.
    Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it.

    process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558)     The use of the deprecated API process.binding() can bypass the permission model through path traversal.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental permission model in Node.js 20.
    Thank you to Rafael Gonzaga for reporting and fixing this vulnerability.

    Permissions policies can impersonate other modules in using module.constructor.createRequire()     (MEDIUM)(CVE-2023-32006)     The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside     of the policy.json definition for a given module.

    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.
    Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias     for fixing it.

    Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559)     The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal     modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the     limits defined in a policy.json file.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    Impacts

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.
    Thank you, to LeoDog896 for reporting this vulnerability and thank you Tobias Nieen for fixing it.

    fs.statfs can retrive stats from files restricted by the Permission Model (LOW)(CVE-2023-32005)     A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission     model when the --allow-fs-read flag is used with a non-* argument.

    This flaw arises from an inadequate permission model that fails to restrict file stats through the     fs.statfs API. As a result, malicious actors can retrieve stats from files that they do not have explicit     read access to.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental permission model in Node.js 20.
    Thank you to Rafael Gonzaga for reporting and fixing this vulnerability.

    fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003)     fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal     attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor     could create an arbitrary directory.

    Please note that at the time this CVE was issued, the permission model is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental permission model in Node.js 20.
    Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it.

    Downloads and release details     Node.js v16.20.2 (LTS)     Node.js v18.17.1 (LTS)     Node.js v20.5.1 (Current)     (Update 08-Aug-2023) Security Release target August 9th     The Node.js Security Releases will be available on, or shortly after, Wednesday, August 9th, 2023.

    Summary     The Node.js project will release new versions of the 16.x, 18.x and 20.x releases lines on or shortly     after, Tuesday August 8th 2023 in order to address:

    3 high severity issues.
    2 medium severity issues.
    2 low severity issues.
    OpenSSL Security updates     This security release includes the following OpenSSL security updates

    OpenSSL security advisory 14th July.
    OpenSSL security advisory 19th July.
    OpenSSL security advisory 31st July.
    Impact     The 20.x release line of Node.js is vulnerable to 3 high severity issues, 2 medium severity issues, and 2     low severity issues.

    The 18.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues.

    The 16.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 16.20.2, 18.17.1, 20.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday August 09 2023 Security Releases advisory:

  - Permissions policies can be bypassed via Module._load (CVE-2023-32002)

  - Permission model bypass by specifying a path traversal sequence in a Buffer (CVE-2023-32004)

  - process.binding() can bypass the permission model through path traversal (CVE-2023-32558)

  - Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006)

  - Permissions policies can be bypassed via process.binding (CVE-2023-32559)

  - fs.statfs can retrive stats from files restricted by the Permission Model (CVE-2023-32005)

  - fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (CVE-2023-32003)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195166	GLSA-202405-29 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
191429	Siemens SINEC NMS < V2.0 SP1 Multiple Vulnerabilities	Nessus	Windows	critical
179978	Fedora 37 : nodejs16 / nodejs18 / nodejs20 (2023-18476abd7e)	Nessus	Fedora Local Security Checks	critical
179885	Fedora 38 : nodejs16 / nodejs18 / nodejs20 (2023-d12a917ab4)	Nessus	Fedora Local Security Checks	critical
179692	Node.js 16.x < 16.20.2 / 18.x < 18.17.1 / 20.x < 20.5.1 Multiple Vulnerabilities (Wednesday August 09 2023 Security Releases).	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-32004

high

Tenable Plugins

critical

critical

critical

critical

critical