CVE-2023-32004: Node.js Path Traversal Vulnerability

CVE-2023-32004 Overview

A path traversal vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs, causing a traversal path to bypass when verifying file permissions. The vulnerability allows authenticated attackers to circumvent the permission model's file access restrictions, potentially gaining unauthorized access to files outside the intended scope.

This vulnerability affects all users using the experimental permission model in Node.js 20. It is important to note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Critical Impact

Attackers with low privileges can bypass the Node.js permission model to read, write, or modify files outside the permitted directory scope, potentially leading to sensitive data exposure or system compromise.

Affected Products

• Node.js version 20.x (using experimental permission model)
• Fedora 37 (via Node.js packages)
• Fedora 38 (via Node.js packages)

Discovery Timeline

• 2023-08-15 - CVE-2023-32004 published to NVD
• 2025-05-08 - Last updated in NVD database

Technical Details for CVE-2023-32004

Vulnerability Analysis

The vulnerability resides in the experimental permission model introduced in Node.js 20. When the permission model is enabled, Node.js implements access controls to restrict file system operations to specified directories. However, a flaw in how the permission verification system handles Buffer objects in file system API calls allows attackers to craft malicious path inputs that bypass these security checks.

The core issue stems from improper input validation when file paths are passed as Buffer objects rather than strings. The permission model's path verification logic fails to properly normalize and validate Buffer-based paths, allowing directory traversal sequences (such as ../) to escape the permitted directory boundaries. This enables an authenticated user with limited file system permissions to access files outside their authorized scope.

Root Cause

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). The permission model's file access verification does not properly handle Buffer inputs in file system APIs. When a path is provided as a Buffer, the normalization and traversal detection mechanisms are bypassed, allowing malicious path constructions to escape the sandboxed directory structure. This improper handling creates an inconsistency between how string paths and Buffer paths are validated against the permission model's allowed paths list.

Attack Vector

The attack is network-accessible and requires low privileges to execute. An attacker must have the ability to execute Node.js code within an application that uses the experimental permission model. By crafting file system API calls with specially constructed Buffer objects containing path traversal sequences, the attacker can bypass the permission model's restrictions and access arbitrary files on the system.

The attack flow typically involves:

1. The attacker identifies an application using Node.js 20's experimental permission model
2. The attacker crafts a file system API call using a Buffer object for the path parameter
3. The Buffer contains path traversal sequences that bypass permission checks
4. The attacker gains access to files outside the permitted directories

The vulnerability does not require user interaction and can be exploited remotely in scenarios where the attacker can influence the execution of Node.js code, such as in server-side applications or development environments.

Detection Methods for CVE-2023-32004

Indicators of Compromise

• Unusual file access patterns from Node.js processes attempting to read or write files outside configured permission boundaries
• File system API calls using Buffer objects with encoded path traversal sequences (..%2f, ..%5c, or similar encodings)
• Unexpected access to sensitive system files or configuration files from applications running with the permission model enabled
• Log entries showing permission model warnings or errors related to path validation

Detection Strategies

• Monitor Node.js application logs for unusual file access attempts, particularly those targeting system directories or sensitive files
• Implement file integrity monitoring (FIM) on critical system files and directories
• Deploy application-level logging that captures file system API calls with their path arguments
• Use SentinelOne's behavioral detection capabilities to identify processes accessing files outside expected boundaries

Monitoring Recommendations

• Enable verbose logging in Node.js applications to capture file system operations
• Configure SIEM rules to alert on path traversal patterns in application logs
• Monitor for Node.js processes spawned with the --experimental-permission flag accessing unexpected file paths
• Implement network segmentation to limit the impact of potential file access breaches

How to Mitigate CVE-2023-32004

Immediate Actions Required

• Update Node.js to the latest patched version that addresses this vulnerability
• Audit applications currently using the experimental permission model to identify potential exposure
• If immediate patching is not possible, consider disabling the experimental permission model until updates can be applied
• Review application code for instances where file paths may be passed as Buffers to file system APIs

Patch Information

Node.js has released security updates to address this vulnerability. Users should upgrade to the latest available version of Node.js 20.x that includes the fix. Security advisories and patch details are available through the following resources:

• HackerOne Report #2038134 - Original vulnerability report
• Fedora Package Announcement for Fedora 37
• Fedora Package Announcement for Fedora 38
• NetApp Security Advisory NTAP-20230915-0009

Workarounds

• Disable the experimental permission model (--experimental-permission flag) if it is not strictly required for your application
• Implement additional application-level path validation and sanitization before passing paths to file system APIs
• Use a Web Application Firewall (WAF) or similar security controls to filter potentially malicious inputs before they reach the Node.js application
• Consider running Node.js applications in containerized environments with restricted file system access to limit the impact of potential bypasses

# Verify Node.js version and check for permission model usage
node --version

# Check if permission model is enabled in running processes
ps aux | grep -E "node.*--experimental-permission"

# Update Node.js on Fedora systems
sudo dnf update nodejs

# For systems using nvm (Node Version Manager)
nvm install --lts
nvm use --lts