CVE-2022-32223

Deeper analysis

Node.js is vulnerable to DLL hijacking on Windows when OpenSSL has been installed with the configuration file at C:\Program Files\Common Files\SSL\openssl.cnf present. Under these conditions, node.exe searches for providers.dll first in the current working directory and then follows the standard Windows DLL search order, enabling an attacker-supplied library to be loaded instead of the legitimate one. The issue is tracked as CWE-427 and carries a CVSS 3.1 score of 7.3.

An attacker with the ability to write a file to a location searched by node.exe can place a malicious providers.dll that will be executed when a privileged or targeted user subsequently runs Node.js. Successful exploitation grants the attacker arbitrary code execution with the privileges of the Node.js process, resulting in full control over confidentiality, integrity, and availability on the affected system. The attack requires local access and limited user interaction.

The EPSS score has remained low and essentially flat, with a current value of 0.0811 and a peak of only 0.0833, indicating no significant post-disclosure surge in exploitation interest. Node.js security releases published in July 2022 address the issue; practitioners should apply the updates referenced in the official advisories.