Vulnerability in Node.js Experimental Permission Model
Summary
CVE-2024-36137: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Affects nodejs versions < 20.15.1-r0. Fixed in 20.15.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications. The experimental permission model in Node.js provides a way to control access to various resources. However, a vulnerability has been discovered in this model when the --allow-fs-write flag is used.
Vulnerability Detail
The Node.js Permission Model does not properly handle file descriptors when performing certain operations like fs.fchown or fs.fchmod. This can allow an attacker with read-only access to a file descriptor to change the owner and permissions of a file. This vulnerability can be exploited to gain unauthorized access to sensitive files or modify critical system files.
How To Fix
Minimum fixed version
20.15.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is essential to apply the recommended fix by updating Node.js to the patched version.
Conclusion
A vulnerability has been identified in the experimental permission model of Node.js, allowing an attacker with read-only access to a file descriptor to change file ownership and permissions. This can lead to unauthorized access or modification of sensitive files. It is recommended to update Node.js to version 20.15.1-r0 or later to mitigate this vulnerability.
See every vulnerability recorded for nodejs →
FAQ
Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to run JavaScript code outside of a web browser, making it suitable for server-side and networking applications.
The experimental permission model in Node.js provides a way to control access to various resources, allowing developers to define fine-grained permissions for different operations.
This vulnerability affects users of the experimental permission model in Node.js who use the --allow-fs-write flag. It allows an attacker with read-only access to a file descriptor to change the owner and permissions of a file, potentially leading to unauthorized access or modification of sensitive files.
To fix this vulnerability, update Node.js to version 20.15.1-r0 or later. Additionally, ensure that the experimental permission model is used correctly and avoid exposing unnecessary read-only file descriptors.
No, there is currently no known workaround for this vulnerability. It is crucial to apply the recommended fix by updating Node.js to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
