CVE-2023-30586

Summary

CVE-2023-30586 is a privilege escalation vulnerability affecting Node.js version 20. It enables the loading of arbitrary OpenSSL engines when the experimental permission model is activated, bypassing or disabling the model. The attack complexity is high, and an attacker can exploit this vulnerability by manipulating the process's stack memory to locate the permission model's enabled state in the host process's heap memory. The crypto.setEngine() API can be used to execute this attack, allowing the attacker to bypass the Node.js permission model entirely. Note that the permission model is an experimental feature in Node.js at the time this CVE was issued.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.