Inadequate Permission Model in Node.js: Vulnerability in nodejs Package
Summary
DEBIAN-CVE-2024-22018: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. Affects nodejs versions < 20.15.1+dfsg-1. Fixed in 20.15.1+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The nodejs package provides the core functionalities of Node.js, including APIs for file system access, networking, and more. This specific vulnerability affects users who utilize the experimental permission model in Node.js, particularly when the --allow-fs-read flag is enabled, leading to potential unauthorized access to file statistics.
Vulnerability Detail
A vulnerability has been identified in Node.js affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js versions 20 and 21. It is crucial to note that this permission model is still considered experimental, and thus, the risk of exploitation is heightened.
How To Fix
Minimum fixed version
20.15.1+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the --allow-fs-read flag while operating under the experimental permission model until the vulnerability is addressed through an update.
Conclusion
In summary, a significant vulnerability exists in the Node.js package affecting users of the experimental permission model. It is crucial for users to update to the patched version to mitigate risks associated with unauthorized file access. Temporary workarounds are available, but the best course of action is to apply the update as soon as possible.
See every vulnerability recorded for nodejs →
FAQ
The vulnerability allows unauthorized access to file statistics through the fs.lstat API when using the experimental permission model with the --allow-fs-read flag.
Node.js versions 20 and 21 are affected by this vulnerability when the experimental permission model is used.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package right away, avoid using the --allow-fs-read flag as a temporary workaround.
The experimental permission model has known vulnerabilities, and its use should be approached with caution until it is fully stabilized and secured.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
