CVE-2023-30585 : What You Need to Know

A vulnerability has been identified in the Node.js (.msi version) installation process, affecting Windows users during repair operations. The issue arises when the environment variable %USERPROFILE% does not exist, potentially leading to the creation of arbitrary folders in unsafe locations. This vulnerability is specific to Windows users who install Node.js using the .msi installer.

Understanding CVE-2023-30585

This vulnerability affects users installing Node.js on Windows using the .msi installer, allowing unprivileged actors to manipulate environment variables and create folders in unintended locations.

What is CVE-2023-30585?

CVE-2023-30585 is a vulnerability in the Node.js (.msi version) installation process on Windows systems. During repair operations, if the %USERPROFILE% environment variable path is not found, arbitrary folders can be created at potentially harmful locations.

The Impact of CVE-2023-30585

The severity of this vulnerability lies in the ability of unprivileged users to modify the Windows registry key, tricking the privileged msiexec.exe process to create folders in unintended and potentially malicious locations.

Technical Details of CVE-2023-30585

This section provides insight into the Vulnerability Description, Affected Systems and Versions, and the Exploitation Mechanism of CVE-2023-30585.

Vulnerability Description

The vulnerability emerges during the repair operation in Node.js (.msi version) installations on Windows. It arises when the %USERPROFILE% environment variable path is missing, leading to unsafe folder creation.

Affected Systems and Versions

Node.js versions 16.20.1, 18.16.1, and 20.3.1 are affected by this vulnerability when installed using the .msi installer on Windows systems.

Exploitation Mechanism

Unprivileged actors can manipulate the %USERPROFILE% environment variable, deceiving the privileged msiexec.exe process to create folders at unintended and potentially malicious locations.

Mitigation and Prevention

To address CVE-2023-30585, consider the Immediate Steps to Take, Long-Term Security Practices, and Patching and Updates.

Immediate Steps to Take

Windows users should be cautious when repairing Node.js installations using the .msi installer. Ensure that the %USERPROFILE% environment variable exists to prevent unsafe folder creation.

Long-Term Security Practices

Regularly monitor and secure environment variables and registry keys to prevent unauthorized modifications that could exploit vulnerabilities like CVE-2023-30585.

Patching and Updates

Node.js users should update to the latest versions that contain fixes for CVE-2023-30585 or consider alternative installation methods to reduce exposure to this vulnerability.