Inadequate Permission Model in Node.js Allows Unauthorized File Stats Retrieval
Summary
CVE-2024-22018: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. Affects nodejs versions < 20.15.1-r0. Fixed in 20.15.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications and is widely used for server-side and networking applications. The experimental permission model in Node.js aims to provide enhanced security by restricting access to certain resources based on permissions. However, a vulnerability has been discovered in this model that allows unauthorized retrieval of file stats through the fs.lstat API.
Vulnerability Detail
The vulnerability arises from the inadequate permission model in Node.js when the --allow-fs-read flag is used. The model fails to properly restrict file stats retrieval, enabling malicious actors to access stats from files they do not have explicit read access to. This can lead to unauthorized access to sensitive information and potential security breaches. The vulnerability affects all users utilizing the experimental permission model in Node.js versions 20 and 21.
How To Fix
Minimum fixed version
20.15.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using the experimental permission model in Node.js or refrain from using the --allow-fs-read flag. By not enabling this flag, the vulnerability can be mitigated. However, this workaround may limit certain functionalities and features provided by the experimental permission model.
Conclusion
The inadequate permission model in Node.js, specifically when using the --allow-fs-read flag, allows unauthorized retrieval of file stats. This can lead to unauthorized access to sensitive information and potential security breaches. It is recommended to upgrade to the fixed version of Node.js to mitigate the vulnerability.
See every vulnerability recorded for nodejs →
FAQ
Node.js is an open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications and is widely used for server-side and networking applications.
The experimental permission model in Node.js aims to provide enhanced security by restricting access to certain resources based on permissions. It is an experimental feature that is still being developed and refined.
The vulnerability allows unauthorized retrieval of file stats through the fs.lstat API when the --allow-fs-read flag is used. This can lead to unauthorized access to sensitive information and potential security breaches.
The vulnerability affects Node.js versions 20 and 21 when the experimental permission model is used.
To fix the vulnerability, users should upgrade to Node.js version 20.15.1-r0 or later, where the issue has been addressed.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
