Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-30583
CVE-2023-30583:
Node.js vulnerability analysis and mitigation
Overview
A vulnerability has been identified in Node.js version 20, where fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag. This flaw arises from a missing check in the fs.openAsBlob() API. The vulnerability was disclosed in June 2023 and affects all users using the experimental permission model in Node.js 20 (Node.js Blog).
Technical details
The vulnerability is tracked as CVE-2023-30583 and has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability exists in the fs.openAsBlob() API implementation, which fails to properly check permissions when the experimental permission model is enabled with the --allow-fs-read flag (NetApp Security).
Impact
Successful exploitation of this vulnerability could lead to disclosure of sensitive information by bypassing the file system read restrictions that were intended to be enforced by the experimental permission model (NetApp Security).
Mitigation and workarounds
The vulnerability has been fixed in Node.js version 20.3.1. Users running affected versions should upgrade to this patched version or later to address the security issue (Node.js Blog).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management