Cloudanix VulnDB

CVE-2023-39333

Medium · 5.3

CVSS

5.3

EPSS

1.1%

Published

Sep 7, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in an experimental feature of Node.js could let specially made code sneak in extra instructions that reach parts of the program it should not, if that feature is turned on.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Maliciously crafted export names in an imported WebAssembly module allow injection of JavaScript code that can access data and functions outside the module's intended scope, as if the module were a native JavaScript module.

Why it matters to the business

Organizations using the experimental WebAssembly modules feature in Node.js face a risk of unauthorized code execution that could expose sensitive application data or functions, potentially leading to data leakage or unexpected behavior in affected services.

How an attack unfolds

An attacker supplies a WebAssembly module containing specially crafted export names that, when imported under the experimental flag, cause the runtime to execute injected JavaScript, granting access beyond the module's sandbox.

How to fix it

Avoid starting Node.js with the --experimental-wasm-modules flag. Update to a release that addresses the input validation issue in WebAssembly module handling.

How to confirm the fix worked

Confirm the --experimental-wasm-modules flag is not used in production command lines and verify Node.js is updated to a non-vulnerable version by checking the runtime version and startup flags.

Typical attack path

  1. Identify an application using Node.js started with --experimental-wasm-modules
  2. Craft a WebAssembly module with malicious export names designed to inject JavaScript
  3. Cause the target application to import the module
  4. Execute injected JavaScript to access restricted data or functions

How to detect it

Review process startup logs and command-line arguments across servers for the presence of --experimental-wasm-modules; inspect application code and dependencies for dynamic loading of WebAssembly modules from untrusted sources.

What your security team should do

  • Immediately disable the --experimental-wasm-modules flag in all environments
  • Audit applications for any use of experimental WebAssembly module imports
  • Monitor for updates to Node.js active release lines and apply patches promptly

The record

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 nodejs 0 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
AlmaLinux:8 nodejs 0 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
AlmaLinux:8 nodejs-devel 0 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
AlmaLinux:8 nodejs-devel 0 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
AlmaLinux:8 nodejs-docs 0 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
AlmaLinux:8 nodejs-docs 0 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
AlmaLinux:8 nodejs-full-i18n 0 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
AlmaLinux:8 nodejs-full-i18n 0 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
AlmaLinux:8 nodejs-nodemon 0 3.0.1-1.module_el8.8.0+3613+1ed8c91d
AlmaLinux:8 nodejs-nodemon 0 3.0.1-1.module_el8.9.0+3675+0258a6d9
AlmaLinux:8 nodejs-packaging 0 2021.06-4.module_el8.7.0+3343+ea2b7901
AlmaLinux:8 nodejs-packaging 0 2021.06-4.module_el8.9.0+3684+11b9e959
AlmaLinux:8 nodejs-packaging-bundler 0 2021.06-4.module_el8.7.0+3343+ea2b7901
AlmaLinux:8 nodejs-packaging-bundler 0 2021.06-4.module_el8.9.0+3684+11b9e959
AlmaLinux:8 npm 0 1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0
AlmaLinux:8 npm 0 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
AlmaLinux:9 nodejs 0 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
AlmaLinux:9 nodejs-devel 0 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
AlmaLinux:9 nodejs-docs 0 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
AlmaLinux:9 nodejs-full-i18n 0 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
AlmaLinux:9 nodejs-nodemon 0 3.0.1-1.module_el9.2.0+36+853e48f5
AlmaLinux:9 nodejs-packaging 0 2021.06-4.module_el9.1.0+13+d9a595ea
AlmaLinux:9 nodejs-packaging-bundler 0 2021.06-4.module_el9.1.0+13+d9a595ea
AlmaLinux:9 npm 0 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20
Alpine:v3.17 nodejs 0 18.18.2-r0
Alpine:v3.18 nodejs 0 18.18.2-r0
Alpine:v3.19 nodejs 0 18.18.2-r0
Alpine:v3.20 nodejs 0 18.18.2-r0
Alpine:v3.21 nodejs 0 18.18.2-r0
Alpine:v3.22 nodejs 0 18.18.2-r0
Bitnami node 0 18.18.2
Bitnami node 19.0.0 20.8.1
Bitnami node-min 0 18.18.2
Bitnami node-min 19.0.0 20.8.1
Chainguard nodejs-16 0 16.20.2-r16
Chainguard nodejs-16-doc 0 16.20.2-r15
Debian:12 nodejs 0 18.19.0+dfsg-6~deb12u1
Debian:13 nodejs 0 18.13.0+dfsg1-1.1
Mageia:9 nodejs 0 18.18.2-1.mga9
Mageia:9 yarnpkg 0 1.22.19-14.mga9
Red Hat:enterprise_linux:8::appstream nodejs 0 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs 0 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
Red Hat:enterprise_linux:8::appstream nodejs-debuginfo 0 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs-debuginfo 0 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
Red Hat:enterprise_linux:8::appstream nodejs-debugsource 0 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs-debugsource 0 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
Red Hat:enterprise_linux:8::appstream nodejs-devel 0 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs-devel 0 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
Red Hat:enterprise_linux:8::appstream nodejs-docs 0 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs-docs 0 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
Red Hat:enterprise_linux:8::appstream nodejs-full-i18n 0 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs-full-i18n 0 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
Red Hat:enterprise_linux:8::appstream nodejs-nodemon 0 0:3.0.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs-nodemon 0 0:3.0.1-1.module+el8.8.0+19757+8ca87034
Red Hat:enterprise_linux:8::appstream nodejs-packaging 0 0:2021.06-4.module+el8.9.0+19519+e25b965a
Red Hat:enterprise_linux:8::appstream nodejs-packaging 0 0:2021.06-4.module+el8.7.0+15582+19c314fa
Red Hat:enterprise_linux:8::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el8.9.0+19519+e25b965a
Red Hat:enterprise_linux:8::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el8.7.0+15582+19c314fa
Red Hat:enterprise_linux:8::appstream npm 0 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream npm 0 1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd
Red Hat:enterprise_linux:9::appstream nodejs 0 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
Red Hat:enterprise_linux:9::appstream nodejs-debuginfo 0 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
Red Hat:enterprise_linux:9::appstream nodejs-debugsource 0 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
Red Hat:enterprise_linux:9::appstream nodejs-devel 0 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
Red Hat:enterprise_linux:9::appstream nodejs-docs 0 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
Red Hat:enterprise_linux:9::appstream nodejs-full-i18n 0 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
Red Hat:enterprise_linux:9::appstream nodejs-nodemon 0 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0
Red Hat:enterprise_linux:9::appstream nodejs-packaging 0 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9::appstream npm 0 1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5
Rocky Linux:8 nodejs-nodemon 0 0:3.0.1-1.module+el8.8.0+1459+02651ab6
Rocky Linux:8 nodejs-packaging 0 0:2021.06-4.module+el8.7.0+1072+5b168780
SUSE:Enterprise Storage 7.1 nodejs16 0 16.20.2-150300.7.30.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS nodejs16 0 16.20.2-150300.7.30.1
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS nodejs16 0 16.20.2-150300.7.30.1
SUSE:Linux Enterprise Module for Web and Scripting 12 nodejs16 0 16.20.2-8.36.1
SUSE:Linux Enterprise Module for Web and Scripting 12 nodejs18 0 18.18.2-8.15.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 nodejs16 0 16.20.2-150400.3.27.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 nodejs18 0 18.18.2-150400.9.15.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 nodejs18 0 18.18.2-150400.9.15.1
SUSE:Linux Enterprise Server 15 SP3-LTSS nodejs16 0 16.20.2-150300.7.30.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP3 nodejs16 0 16.20.2-150300.7.30.1
SUSE:Manager Server 4.2 nodejs16 0 16.20.2-150300.7.30.1
Ubuntu:20.04:LTS nodejs 0 No fix
Ubuntu:22.04:LTS nodejs 0 No fix
Ubuntu:24.04:LTS nodejs 0 No fix
Ubuntu:24.10 nodejs 0 No fix
Ubuntu:Pro:14.04:LTS nodejs 0 No fix
Ubuntu:Pro:16.04:LTS nodejs 0 No fix
Ubuntu:Pro:18.04:LTS nodejs 0 No fix
Ubuntu:Pro:22.04:LTS nodejs 0 No fix
Wolfi nodejs-16 0 16.20.2-r16
Wolfi nodejs-16-doc 0 16.20.2-r15
openSUSE:Tumbleweed nodejs-electron 0 25.9.1-2.1
openSUSE:Tumbleweed nodejs20 0 20.8.1-1.1

Related vulnerabilities