CVE-2023-30585

Summary

CVE	CVE-2023-30585
State	PUBLISHED
Assigner	hackerone
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-11-28 02:15:42 UTC
Updated	2026-10-08 22:17:23 UTC
Description	A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry. The issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the "msiexec.exe" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations. The severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or "non-privileged") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged "msiexec.exe" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations. It is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Problem Types: NVD-CWE-noinfo

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Nodejs	Node.js	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	NodeJS	Node	affected 4.0 4.* semver	Not specified
CNA	NodeJS	Node	affected 5.0 5.* semver	Not specified
CNA	NodeJS	Node	affected 6.0 6.* semver	Not specified
CNA	NodeJS	Node	affected 7.0 7.* semver	Not specified
CNA	NodeJS	Node	affected 8.0 8.* semver	Not specified
CNA	NodeJS	Node	affected 9.0 9.* semver	Not specified
CNA	NodeJS	Node	affected 10.0 10.* semver	Not specified
CNA	NodeJS	Node	affected 11.0 11.* semver	Not specified
CNA	NodeJS	Node	affected 12.0 12.* semver	Not specified
CNA	NodeJS	Node	affected 13.0 13.* semver	Not specified
CNA	NodeJS	Node	affected 14.0 14.* semver	Not specified
CNA	NodeJS	Node	affected 15.0 15.* semver	Not specified
CNA	NodeJS	Node	affected 16.0 16.20.1 semver	Not specified
CNA	NodeJS	Node	affected 17.0 17.* semver	Not specified
CNA	NodeJS	Node	affected 18.0 18.16.1 semver	Not specified
CNA	NodeJS	Node	affected 19.0 19.* semver	Not specified
CNA	NodeJS	Node	affected 20.0 20.3.1 semver	Not specified

References

Reference	Source	Link	Tags
security.netapp.com/advisory/ntap-20241101-0011	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com
nodejs.org/en/blog/vulnerability/june-2023-security-releases	af854a3a-2127-422b-91ae-364da2661108	nodejs.org	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

284323 Fedora Security Update for nodejs18 (FEDORA-2023-6b866fbe84)
284328 Fedora Security Update for nodejs16 (FEDORA-2023-61e40652be)
284329 Fedora Security Update for nodejs16 (FEDORA-2023-608a1417d3)
284330 Fedora Security Update for nodejs18 (FEDORA-2023-cdddce304a)
754181 SUSE Enterprise Linux Security Update for nodejs16 (SUSE-SU-2023:2861-1)