CVE-2023-39333

Vulnerability

Overview

CVE-2023-39333 is a code injection vulnerability in Node.js that arises when the experimental WebAssembly modules feature is enabled via the --experimental-wasm-modules command-line option. Maliciously crafted export names in an imported WebAssembly module can inject arbitrary JavaScript code into the Node.js process. This occurs because the export names are not properly sanitized before being evaluated, allowing an attacker to break out of the expected context.

Exploitation

Conditions

To exploit this vulnerability, an attacker must supply a WebAssembly module with specially crafted export names. The vulnerable feature is only active if Node.js is started with the --experimental-wasm-modules flag, which is not enabled by default. The injected JavaScript code runs in the same privilege context as the Node.js application, potentially accessing data and functions that the WebAssembly module itself does not have access to, similar to a JavaScript module.

Impact

Successful exploitation could allow an attacker to access sensitive data or call internal functions that are not exposed to the WebAssembly module. This could lead to information disclosure, privilege escalation, or further compromise of the Node.js application and its environment.

Mitigation

Node.js released security updates for the v18.x and v20.x release lines in October 2023 to address this vulnerability [1]. Users are strongly advised to upgrade to the latest patched versions. As an additional precaution, users who do not require the experimental WebAssembly modules feature should avoid enabling it with --experimental-wasm-modules.