Skip to content
Fencer Intel
high 7.5

CVE-2023-30585 json

A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install No…

published 2y ago modified last mo. also BIT-node-2023-30585 , BIT-node-min-2023-30585 , EUVD-2023-34966

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry.

The issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the "msiexec.exe" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations.

The severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or "non-privileged") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged "msiexec.exe" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations.

It is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue.

Patch / fix

  • bitnami node 16.20.1, 18.16.1, 20.3.1
  • bitnami node-min 16.20.1, 18.16.1, 20.3.1
  • NodeJS Node 16.20.1, 18.16.1, 20.3.1
  • nodejs16 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +3 more 16.20.1-150300.7.24.2
  • nodejs18 SLE Module for Web and Scripting 15 SP5, SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.5 +1 more 18.16.1-150400.9.9.1
  • nodejs16 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.4 16.20.1-150400.3.21.1
  • nodejs18 SLE Module for Web and Scripting 12 18.16.1-8.9.1
  • nodejs16 SLE Module for Web and Scripting 12 16.20.1-8.30.1

suse advisories SUSE-SU-2023:2861-1SUSE-SU-2023:2669-1SUSE-SU-2023:2663-1SUSE-SU-2023:2662-1SUSE-SU-2023:2655-1

  • nodejs20 openSUSE Tumbleweed 20.3.1-1.1

opensuse advisories openSUSE-SU-2024:13021-1

Is CVE-2023-30585 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-30585 updated cvss 7.5

nodejs: privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process

  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
last mo.

Exploit prediction

1.47% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami node
>=16.0.0, <16.20.1
>=18.0.0, <18.16.1
>=20.0.0, <20.3.1
16.20.1
18.16.1
20.3.1
bitnami node-min
>=16.0.0, <16.20.1
>=18.0.0, <18.16.1
>=20.0.0, <20.3.1
16.20.1
18.16.1
20.3.1

Affected products

  • NodeJS Node

Classification

Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.