CVE-2022-32223
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, node.exe will search for providers.dll in the current user directory.After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file providers.dll under a variety of paths and exploit this vulnerability.
影響パッケージ
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.14.0"},{"fixed":"14.20.0"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.16.0"},{"introduced":"18.0.0"},{"fixed":"18.0.5"}]}]
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.14.0"},{"fixed":"14.20.0"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.16.0"},{"introduced":"18.0.0"},{"fixed":"18.0.5"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2022-32223 nodejs
参照URL
- advisory nodejs.org
- advisory security.netapp.com
- web hackerone.com
- web nvd.nist.gov