Node.js 20 Privilege Escalation Vulnerability in OpenSSL Engine

CVE-2023-30586

What is CVE-2023-30586?

A privilege escalation vulnerability in Node.js 20 allows for the loading of arbitrary OpenSSL engines when the experimental permission model is activated. This vulnerability enables attackers to bypass and even disable the permission model, which could lead to unauthorized actions within the application. Specifically, the crypto.setEngine() API can manipulate the permission model's settings by interacting with compatible OpenSSL engines, potentially disabling safeguards within the host process. Attackers can exploit this flaw by accessing and altering sensitive stack memory locations, creating a serious security concern, particularly as the permission model is still in its experimental stage.

References