CVE-2023-45133: Debian Linux Babel RCE Vulnerability

CVE-2023-45133 Overview

CVE-2023-45133 is an arbitrary code execution vulnerability in @babel/traverse, a core component of the Babel JavaScript compiler. When compiling specially crafted malicious code, attackers can achieve arbitrary code execution during the compilation process. This vulnerability affects the internal path.evaluate() and path.evaluateTruthy() methods used by several Babel plugins including @babel/plugin-transform-runtime, @babel/preset-env (when using the useBuiltIns option), and various polyfill provider plugins.

Critical Impact

Attackers can execute arbitrary code on developer machines or CI/CD build servers during the JavaScript compilation process by providing maliciously crafted source code to Babel.

Affected Products

• babeljs babel (versions prior to 7.23.2 and 8.0.0-alpha.4)
• babeljs babel-helper-define-polyfill-provider (versions prior to 0.4.3)
• babeljs babel-plugin-polyfill-corejs2 (versions prior to 0.4.6)
• babeljs babel-plugin-polyfill-corejs3 (versions prior to 0.8.5)
• babeljs babel-plugin-polyfill-es-shims (versions prior to 0.10.0)
• babeljs babel-plugin-polyfill-regenerator (versions prior to 0.5.3)
• babeljs babel-plugin-transform-runtime (versions prior to 7.23.2)
• babeljs babel-preset-env (versions prior to 7.23.2)
• debian debian_linux (10.0, 11.0, 12.0)

Discovery Timeline

• 2023-10-12 - CVE CVE-2023-45133 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-45133

Vulnerability Analysis

This vulnerability stems from incomplete input validation (CWE-184) and incorrect comparison logic (CWE-697) in Babel's code evaluation mechanism. The @babel/traverse package provides path traversal utilities used during AST (Abstract Syntax Tree) manipulation. The vulnerable path.evaluate() and path.evaluateTruthy() methods are designed to statically evaluate JavaScript expressions at compile time, but they improperly allowed access to prototype chain methods on global objects like String, Number, and Math.

When Babel plugins call these evaluation methods on attacker-controlled code, the incomplete allowlist logic permitted method access beyond the intended safe methods. This allows an attacker to craft JavaScript source code that, when compiled by Babel with certain plugins enabled, executes arbitrary code in the context of the Node.js process running the compiler.

Root Cause

The root cause lies in the property access validation within the evaluation logic. The original code directly accessed properties on global context objects without verifying that the property was an own property of the object. This allowed attackers to access methods inherited from the prototype chain, bypassing the intended restrictions. The fix implements proper ownership verification using Object.hasOwnProperty.call() to ensure only directly defined properties are accessible during evaluation.

Attack Vector

The attack requires local access where an attacker must provide malicious JavaScript source code to a build system using vulnerable Babel versions. The exploitation occurs during compilation when specific plugins invoke the vulnerable evaluation methods. Known affected plugins include @babel/plugin-transform-runtime, @babel/preset-env with its useBuiltIns option, and polyfill provider plugins that depend on @babel/helper-define-polyfill-provider.

Attack scenarios include:

• Supply chain attacks where malicious npm packages contain crafted code
• Pull request poisoning in open source projects
• Compromised dependencies in CI/CD pipelines

         !isInvalidMethod(property.node.name)
       ) {
         context = global[object.node.name];
-        // @ts-expect-error property may not exist in context object
-        func = context[property.node.name];
+        const key = property.node.name;
+        // TODO(Babel 8): Use Object.hasOwn
+        if (Object.hasOwnProperty.call(context, key)) {
+          func = context[key as keyof typeof context];
+        }
       }
 
       // "abc".charCodeAt(4)

Source: GitHub Commit b13376b

Detection Methods for CVE-2023-45133

Indicators of Compromise

• Unexpected process spawning or network connections during JavaScript build processes
• Unusual file system access patterns from Node.js processes running Babel compilation
• Modified or suspicious entries in package-lock.json or yarn.lock referencing vulnerable Babel package versions
• Build log anomalies showing execution of code unrelated to the compilation process

Detection Strategies

• Implement Software Composition Analysis (SCA) scanning to identify vulnerable @babel/traverse versions in project dependencies
• Monitor CI/CD build environments for anomalous behavior during JavaScript compilation stages
• Use dependency auditing tools such as npm audit or yarn audit to flag vulnerable Babel packages
• Review pull requests and external contributions for suspicious JavaScript patterns that may trigger the vulnerable code paths

Monitoring Recommendations

• Enable process monitoring on build servers to detect unexpected child process creation during npm/yarn build scripts
• Implement file integrity monitoring on build infrastructure to detect unauthorized modifications
• Configure alerts for network connections originating from build processes that should be offline or restricted

How to Mitigate CVE-2023-45133

Immediate Actions Required

• Upgrade @babel/traverse to version 7.23.2 or 8.0.0-alpha.4 or later immediately
• Audit all projects for vulnerable Babel package versions using npm ls @babel/traverse or yarn why @babel/traverse
• Review build logs for any suspicious activity that may indicate prior exploitation
• Ensure build environments are isolated and have minimal network access

Patch Information

The vulnerability has been fixed in @babel/traverse@7.23.2 and @babel/traverse@8.0.0-alpha.4. Security patches are available from the Babel GitHub releases. For those unable to upgrade @babel/traverse directly, upgrade the dependent packages to their patched versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, and babel-plugin-polyfill-regenerator v0.5.3. Debian users should apply the security updates per DSA-5528.

Workarounds

• If immediate upgrade is not possible, upgrade only the affected plugins to their latest versions which avoid triggering the vulnerable code path
• Restrict build processes to only compile trusted, internally-reviewed source code
• Implement strict code review policies for any external or third-party code before compilation
• Consider containerizing build environments with restricted permissions to limit potential impact

# Upgrade @babel/traverse to patched version
npm install @babel/traverse@7.23.2

# Or upgrade all affected packages
npm install @babel/plugin-transform-runtime@7.23.2 @babel/preset-env@7.23.2

# Verify installed versions
npm ls @babel/traverse