# Permissions policies can be bypassed via Module._load and require.extensions (High) (CVE-2023-30587)

Node.js experimental permission policy can be bypassed via Module._load() and require.extensions to load modules like child_process outside policy.json, enabling RCE.

- Payout: $1,165
- Severity: high
- Program: Internet Bug Bounty
- Found by: mattaustin
- Disclosed: 2023-11-30
- CVE: CVE-2023-32002
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2188126
- Library page: https://bugbountylibrary.com/r/h1%3A2188126
- Tags: area:oss domain:oss impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:nodejs technique:source-review vuln:access-control vuln:rce

**Target:** Node.js experimental permission policy mechanism (policy.json)
**Root cause:** The policy mechanism only intercepts the standard require path; Module._load() and require.extensions[".js"] reach the module loader directly, so modules outside policy.json (e.g. child_process) can be required.
**Steps:**
1. Configure a policy.json restricting built-in modules such as child_process.
2. Instead of require('child_process'), invoke `Module._load('child_process')` to load the restricted module.
3. Alternatively register a handler via `require.extensions[".js"]` to load modules outside the policy.
4. Use the loaded child_process to execute commands, achieving RCE despite the policy.
**Exploitation:** A project relying on policy.json to block child_process can be bypassed by loading it through Module._load() or require.extensions, then spawning a shell for remote code execution.
**Insight:** Experimental sandbox/policy features that hook only the documented entry point (require) leave lower-level loader internals like Module._load and require.extensions as bypass paths; enumerate all module-loading APIs when auditing such restrictions.