PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-32003 NodeJS CVE debrief

CVE-2023-32003 is a path traversal vulnerability in Node.js 20's experimental permission model that allows directory creation outside intended boundaries. The flaw exists in `fs.mkdtemp()` and `fs.mkdtempSync()` APIs due to missing path traversal checks. Siemens SINEC INS is affected through its Node.js dependency. The vulnerability has a CVSS 3.1 score of 5.3 (MEDIUM) with network attack vector, low complexity, no privileges required, and no user interaction needed. The impact is limited to integrity (low) with no confidentiality or availability impact. This CVE was published on November 12, 2024, and is not listed in CISA's Known Exploited Vulnerabilities catalog. The experimental nature of Node.js's permission model at the time of disclosure means production deployments with this feature enabled were limited. Siemens has released a vendor fix in SINEC INS V1.0 SP2 Update 3.

Vendor
NodeJS
Product
SINEC INS
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-13
Original CVE updated
2024-03-12
Advisory published
2024-02-13
Advisory updated
2024-03-12

Who should care

Organizations running Siemens SINEC INS with Node.js 20 experimental permission model enabled, industrial control system operators, Node.js developers using experimental security features, and security teams monitoring ICS supply chain dependencies.

Technical summary

The vulnerability stems from insufficient path validation in Node.js 20's `fs.mkdtemp()` and `fs.mkdtempSync()` functions when the experimental permission model is active. An attacker can exploit this by providing directory paths containing traversal sequences (e.g., `../`) to create directories outside the intended scope, bypassing permission checks. The attack requires network access to an application using the vulnerable API with the experimental permission model enabled. The Siemens SINEC INS product incorporates the affected Node.js component, exposing industrial control environments to this integrity impact vulnerability.

Defensive priority

medium

Recommended defensive actions

  • Apply Siemens vendor fix: Update SINEC INS to V1.0 SP2 Update 3 or later version
  • Review Node.js permission model configurations if experimental features are enabled
  • Validate directory creation permissions in application security policies
  • Monitor CISA ICS advisories for related industrial control system guidance

Evidence notes

CVE description confirms path traversal via fs.mkdtemp() APIs in Node.js 20 experimental permission model. CISA CSAF advisory ICSA-24-319-08 confirms Siemens SINEC INS affected product with vendor fix available. CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates network-exploitable with integrity impact only. No KEV entry present.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-32003 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-32003

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-32003 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-32003

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-319-08.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-915275.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-915275.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-319-08

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.