Node.js up to 20.11.0/21.6.1 Experimental Permission Model permission

Summaryinfo

A vulnerability has been found in Node.js up to 20.11.0/21.6.1 and classified as critical. This affects an unknown function of the component Experimental Permission Model. This manipulation causes permission. This vulnerability is registered as CVE-2024-22018. The attack needs to be launched locally. No exploit is available.

Detailsinfo

A vulnerability was found in Node.js up to 20.11.0/21.6.1. It has been declared as problematic. Affected by this vulnerability is an unknown part of the component Experimental Permission Model. The manipulation with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality. The summary by CVE is:

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

It is possible to read the advisory at hackerone.com. This vulnerability is known as CVE-2024-22018 since 01/04/2024. The exploitation appears to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 210001 (Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-749)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (210001). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• JavaScript Library

Name

• Node.js

Version

• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.8
• 20.9
• 20.10
• 20.11.0
• 21.6.0
• 21.6.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion