CVE-2022-32222: Node.js Information Disclosure Vulnerability

CVE-2022-32222 Overview

A cryptographic vulnerability exists in Node.js on Linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3. This vulnerability allows potential manipulation of OpenSSL configuration by unauthorized users.

Critical Impact

Non-admin users may be able to influence OpenSSL configuration through an insecure default path, potentially allowing cryptographic settings manipulation in Node.js applications.

Affected Products

• Node.js versions 18.x prior to 18.40.0
• Siemens SINEC INS (all versions)
• Siemens SINEC INS 1.0 (including SP1 and SP2)

Discovery Timeline

• July 14, 2022 - CVE-2022-32222 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-32222

Vulnerability Analysis

This vulnerability is classified under CWE-310 (Cryptographic Issues) and CWE-427 (Uncontrolled Search Path Element). The issue stems from changes introduced during the upgrade to OpenSSL 3 in Node.js 18.x, where the default search path for the OpenSSL configuration file (openssl.cnf) was inadvertently changed to a location that may be writable by non-administrative users under certain system configurations.

Prior to the OpenSSL 3 upgrade, Node.js consistently used /etc/ssl as the configuration path, which is typically protected by appropriate file system permissions. The change in behavior introduced a potential security boundary violation where unprivileged users could potentially place a malicious openssl.cnf file in the new default path.

Root Cause

The root cause of this vulnerability lies in the uncontrolled search path element introduced during the OpenSSL 3 integration. When Node.js loads OpenSSL, it searches for configuration files in a specific order. The change to OpenSSL 3 modified this search path behavior, potentially allowing configuration files to be loaded from user-accessible directories rather than the traditionally secured /etc/ssl location.

Attack Vector

An attacker with local access to a Linux system running a vulnerable version of Node.js could potentially exploit this vulnerability by placing a crafted openssl.cnf file in the accessible default path. This could allow the attacker to influence cryptographic operations performed by Node.js applications, potentially weakening encryption, manipulating certificate validation, or affecting other security-sensitive cryptographic behaviors.

The attack requires local access to the system and the ability to write to the vulnerable default configuration path. Successful exploitation could impact the integrity of cryptographic operations without affecting confidentiality or availability directly.

Detection Methods for CVE-2022-32222

Indicators of Compromise

• Unexpected openssl.cnf files appearing in non-standard locations outside /etc/ssl
• Modifications to OpenSSL configuration files by unauthorized users
• Unusual cryptographic behavior in Node.js applications
• File system audit logs showing configuration file creation in the vulnerable path

Detection Strategies

• Monitor file system changes in directories that may be used as OpenSSL configuration paths
• Implement file integrity monitoring for OpenSSL configuration files across the system
• Audit Node.js application behavior for unexpected cryptographic operations
• Review system logs for unauthorized file creation activities in potential configuration directories

Monitoring Recommendations

• Enable file access auditing on directories where openssl.cnf files may be loaded
• Configure SentinelOne to monitor for suspicious file creation patterns related to OpenSSL configuration
• Implement alerts for changes to cryptographic configuration files
• Regularly audit Node.js version deployments to identify vulnerable instances

How to Mitigate CVE-2022-32222

Immediate Actions Required

• Upgrade Node.js to version 18.40.0 or later to remediate this vulnerability
• Audit existing systems for any unauthorized openssl.cnf files in non-standard locations
• Restrict file system permissions on directories that could be used as OpenSSL configuration paths
• Review application deployment configurations to ensure secure OpenSSL paths are specified

Patch Information

The vulnerability is addressed in Node.js version 18.40.0 and later. Organizations should prioritize upgrading affected Node.js installations. For Siemens SINEC INS deployments, consult Siemens security advisories for specific patch guidance. Additional technical details about this vulnerability can be found in the HackerOne Report #1695596.

Workarounds

• Explicitly configure the OPENSSL_CONF environment variable to point to /etc/ssl/openssl.cnf or another secured location
• Implement strict file system permissions to prevent non-admin users from writing to potential configuration directories
• Use containerization to isolate Node.js applications and control the file system environment
• Deploy application-level controls to validate OpenSSL configuration integrity at startup

# Configuration example
# Set secure OpenSSL configuration path explicitly
export OPENSSL_CONF=/etc/ssl/openssl.cnf

# Verify permissions on OpenSSL configuration directory
chmod 755 /etc/ssl
chmod 644 /etc/ssl/openssl.cnf
chown root:root /etc/ssl/openssl.cnf

# Audit for openssl.cnf files in non-standard locations
find / -name "openssl.cnf" -not -path "/etc/ssl/*" 2>/dev/null