PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-39332 NodeJS CVE debrief

CVE-2023-39332 is a critical path traversal vulnerability in Node.js affecting Siemens SINEC INS. The flaw exists because Node.js `node:fs` functions inadequately validate `Uint8Array` objects (excluding `Buffer` instances) for path traversal sequences, allowing attackers to bypass security controls that properly block string-based and `Buffer`-based traversal attempts. This vulnerability is distinct from but related to CVE-2023-32004, which addressed the same issue for `Buffer` objects. At the time of CVE issuance, Node.js's permission model was an experimental feature. The vulnerability enables unauthenticated remote attackers to achieve arbitrary file read, write, and execution capabilities with CVSS 9.8 severity. Siemens has released a vendor fix in SINEC INS V1.0 SP2 Update 3.

Vendor
NodeJS
Product
SINEC INS
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-11-12
Original CVE updated
2024-11-12
Advisory published
2024-11-12
Advisory updated
2024-11-12

Who should care

Organizations operating Siemens SINEC INS industrial network management systems, OT security teams, Node.js application developers using `Uint8Array` path inputs, and critical infrastructure operators following CISA ICS advisories

Technical summary

CVE-2023-39332 exploits incomplete path traversal validation in Node.js `node:fs` functions. While Node.js correctly blocks traversal sequences in string paths (CVE-2023-30584) and `Buffer` objects (CVE-2023-32004), it fails to sanitize non-`Buffer` `Uint8Array` objects. Since `Buffer` extends `Uint8Array`, attackers can craft malicious paths using raw `Uint8Array` instances to bypass security controls. This enables arbitrary file system operations including read, write, and execution. The vulnerability affects Siemens SINEC INS industrial control system software. The experimental Node.js permission model at CVE issuance time may have limited mitigation options for affected deployments.

Defensive priority

critical

Recommended defensive actions

  • Apply Siemens vendor fix: Update SINEC INS to V1.0 SP2 Update 3 or later
  • Review and restrict network access to SINEC INS management interfaces
  • Monitor for anomalous file system access patterns in Node.js applications
  • Validate all path inputs in custom Node.js applications using `Uint8Array` objects
  • Implement defense-in-depth controls per CISA ICS recommended practices

Evidence notes

CISA ICS advisory ICSA-24-319-08 published 2024-11-12 identifies Siemens SINEC INS as affected by CVE-2023-39332. The advisory references Siemens security advisory SSA-915275. The vulnerability stems from incomplete path traversal protection in Node.js `node:fs` functions when processing non-`Buffer` `Uint8Array` path inputs.

Official resources

2024-11-12