Loading HuntDB...

(CVE-2023-32006) Permissions policies can impersonate other modules in using module.constructor.createRequire()

Medium
I
Internet Bug Bounty
Submitted None

Team Summary

Official summary from Internet Bug Bounty

Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006) The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Thank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga and Bradley Farias for fixing it. Security Advisory: https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006

Reported by haxatron1

Vulnerability Details

Technical details and impact analysis

https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006 https://hackerone.com/reports/2043807 Patch was provided about maintainer opted for different approach. ## Impact see reports

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted