CVE-2023-30587
Severity CVSS v4.0:
Pending analysis
Type:
CWE-284
Improper Access Control
Publication date:
07/09/2024
Last modified:
09/09/2024
Description
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).<br />
<br />
By exploiting the Worker class&#39;s ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl. This vulnerability exclusively affects Node.js users employing the permission model mechanism.<br />
<br />
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH