Internet Bug Bounty · Report #2188126
Permissions policies can be bypassed via Module._load and require.extensions (High) (CVE-2023-30587)
Summary
Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002) The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.
Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Thank you, to mattaustin for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias for fixing it.
Full Security Advisory: https://nodejs.org/en/blog/vulnerability/august-2023-security-releases
How it was found
https://hackerone.com/reports/1960870
The use of Module._load() and require.extensions[".js"] can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Impact
Permission policies limit a project to a specific set of authorized node js built-in modules. For example a project could attempt to limit the use of child_process which could be bypassed leading to remote code execution.