CVE-2022-32222: Node.js Information Disclosure Vulnerability

CVE-2022-32222 Overview

CVE-2022-32222 is a cryptographic configuration vulnerability affecting Node.js on Linux systems. The flaw exists in versions of the 18.x release line prior to 18.40.0. Node.js searches for openssl.cnf at a default path that may be writable by non-administrative users. Earlier Node.js builds relied on /etc/ssl/openssl.cnf, but the upgrade to OpenSSL 3 changed the lookup behavior. An attacker with local write access to the search path can supply a malicious OpenSSL configuration. This configuration influences cryptographic operations performed by the Node.js process. Siemens SINEC INS products embedding affected Node.js versions are also impacted. The weakness is tracked under [CWE-310] (Cryptographic Issues) and [CWE-427] (Uncontrolled Search Path Element).

Critical Impact
A non-privileged local user can plant an openssl.cnf file that Node.js loads at runtime, undermining the integrity of cryptographic operations performed by the affected process.

Affected Products

Node.js 18.x releases prior to 18.40.0 on Linux
Siemens SINEC INS 1.0, SP1, and SP2
Applications and services bundling vulnerable Node.js builds

Discovery Timeline

2022-07-14 - CVE-2022-32222 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-32222

Vulnerability Analysis

Node.js initializes OpenSSL at process startup and reads configuration directives from openssl.cnf. The configuration file controls providers, engines, default algorithms, and other cryptographic parameters. After Node.js 18 adopted OpenSSL 3, the lookup path for this file shifted from /etc/ssl/openssl.cnf to a location that, on some Linux distributions, resolves to a directory writable by non-admin users. A local attacker who controls that directory can introduce a crafted configuration file. When the Node.js process starts, OpenSSL parses the attacker-controlled file and applies its directives. The resulting behavior can degrade or redirect cryptographic operations performed by Node.js applications. The issue has limited impact on integrity but does not directly disclose data or cause denial of service.

Root Cause

The root cause is an uncontrolled search path element [CWE-427] combined with a cryptographic configuration weakness [CWE-310]. Node.js trusts the default OpenSSL configuration path supplied during the OpenSSL 3 build. On Linux, this default did not align with the historically protected /etc/ssl directory. The application loads configuration content from a location it does not validate or restrict to administrative ownership.

Attack Vector

The vulnerability requires a writable default openssl.cnf location on the target host. An attacker plants a malicious configuration file at that path. When a privileged user or service later launches a Node.js 18.x process, OpenSSL reads the attacker-controlled directives. The attacker influences cryptographic providers and algorithm selection without modifying Node.js binaries.

No verified proof-of-concept code is published for this issue. See the HackerOne Report #1695596 for additional technical context.

Detection Methods for CVE-2022-32222

Indicators of Compromise

Presence of an openssl.cnf file in a non-administrative directory that is consulted by Node.js at startup
Unexpected modifications to OpenSSL provider or engine directives on hosts running Node.js 18.x
Node.js processes loading configuration files outside /etc/ssl/

Detection Strategies

Inventory installed Node.js versions and flag any Linux host running 18.x prior to 18.40.0
Use file integrity monitoring on default OpenSSL configuration search paths reported by node -p "process.config" and openssl version -d
Audit process startup telemetry for Node.js invocations that reference unexpected OPENSSL_CONF environment variables

Monitoring Recommendations

Track file creation events for openssl.cnf written by non-root accounts
Alert on Node.js processes spawning with cryptographic configuration paths outside /etc/ssl
Correlate package manager events with Node.js runtime versions to detect drift from patched builds

How to Mitigate CVE-2022-32222

Immediate Actions Required

Upgrade Node.js 18.x deployments to 18.40.0 or later on all Linux hosts
Apply the Siemens SINEC INS update that incorporates the patched Node.js runtime
Remove any openssl.cnf files located in directories writable by non-administrative users

Patch Information

Node.js resolved the issue in the 18.x line at version 18.40.0 by aligning the default OpenSSL configuration lookup with the expected administrative path. Siemens released advisories addressing affected SINEC INS releases. Confirm fixed runtime versions through your distribution's package manager or the official Node.js binary distributions.

Workarounds

Explicitly set the OPENSSL_CONF environment variable to a root-owned path such as /etc/ssl/openssl.cnf for all Node.js services
Restrict directory permissions on any path Node.js resolves for openssl.cnf so only root can write
Run Node.js services under dedicated service accounts with restricted filesystem access

bash

# Configuration example: enforce a trusted OpenSSL config path for Node.js
export OPENSSL_CONF=/etc/ssl/openssl.cnf
chown root:root /etc/ssl/openssl.cnf
chmod 644 /etc/ssl/openssl.cnf
node --version  # verify >= 18.40.0