Node.js Vulnerability in Experimental Permission Model - CVE-2024-36137
Summary
ALPINE-CVE-2024-36137: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Affects nodejs versions < 20.15.1-r0. Fixed in 20.15.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The package 'nodejs' in Alpine Linux provides this runtime environment. The vulnerability identified in CVE-2024-36137 affects users utilizing the experimental permission model, particularly when the --allow-fs-write flag is enabled, which can lead to unauthorized file permission changes.
Vulnerability Detail
A vulnerability has been identified in Node.js, specifically affecting users who employ the experimental permission model with the --allow-fs-write flag. The permission model does not operate on file descriptors, allowing operations like fs.fchown or fs.fchmod to use a 'read-only' file descriptor to alter the owner and permissions of a file. This could lead to unauthorized access or modifications to files, posing a significant security risk.
How To Fix
Minimum fixed version
20.15.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the --allow-fs-write flag when running Node.js applications that utilize the experimental permission model. This will prevent the vulnerability from being exploited until the package can be updated.
Conclusion
The vulnerability CVE-2024-36137 in Node.js poses a significant risk to users employing the experimental permission model with the --allow-fs-write flag. It is crucial to update to the patched version of the package to ensure security. Until then, users should avoid using the vulnerable flag to protect their applications.
See every vulnerability recorded for nodejs →
FAQ
CVE-2024-36137 is a vulnerability in Node.js that affects the experimental permission model, allowing unauthorized changes to file permissions when using the --allow-fs-write flag.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to files and the ability to change file permissions, which could lead to data breaches or system compromise.
Yes, a patch is available in the form of the updated 'nodejs' package version 20.15.1-r0 or later.
If you cannot update the package, avoid using the --allow-fs-write flag as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
