Incomplete Fix Bypass in nodejs package on Alpine:v3.19 and Alpine:v3.20
Summary
CVE-2024-36138: Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. Affects nodejs versions < 0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nodejs package is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to execute JavaScript code outside of a web browser, making it a versatile tool for server-side applications. The package is widely used in various ecosystems, including Alpine Linux distributions. However, the nodejs package on Alpine:v3.19 and Alpine:v3.20 is vulnerable to an incomplete fix bypass.
Vulnerability Detail
The vulnerability, identified as CVE-2024-36138, is a bypass of a previously incomplete fix for CVE-2024-27980. It arises from improper handling of batch files with all possible extensions on Windows via the child_process.spawn/child_process.spawnSync functions. An attacker can exploit this vulnerability by injecting arbitrary commands through a malicious command line argument, even if the shell option is not enabled. This can lead to code execution and potential compromise of the affected system.
How To Fix
To fix this vulnerability, it is recommended to update the nodejs package on Alpine:v3.19 and Alpine:v3.20 to a version that includes a complete fix for CVE-2024-27980. The package maintainers should release a patched version addressing this issue. Users should update their packages as soon as the fix becomes available.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. It is crucial to apply the official fix once it is released to ensure the security of the system.
Conclusion
The nodejs package on Alpine:v3.19 and Alpine:v3.20 is vulnerable to an incomplete fix bypass, allowing for arbitrary command execution. It is crucial for users to update their packages to a version that includes a complete fix once it becomes available. No known workaround exists for this vulnerability at present.
See every vulnerability recorded for nodejs →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the affected system, potentially leading to unauthorized access, data breaches, or further compromise of the system.
No, this vulnerability requires a malicious command line argument to be provided locally on the affected system.
Yes, all versions of the nodejs package on Alpine:v3.19 and Alpine:v3.20 are affected until a patched version is released.
There is no evidence of active exploitation of this vulnerability at the moment. However, it is crucial to apply the fix once it becomes available to mitigate any potential risks.
You can find more information about this vulnerability in the CVE-2024-36138 entry at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36138.json
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
