Node.js Permission Model Misconfiguration in nodejs Package - CVE-2024-21890
Summary
UBUNTU-CVE-2024-21890: The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. Affects nodejs versions 20.16.0+dfsg-1ubuntu1 – 20.18.1+dfsg-1ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. The nodejs package provides the core functionality for running Node.js applications. This package is widely used in server-side development and supports various features, including an experimental permission model introduced in versions 20 and 21. However, this model has a critical documentation flaw that can lead to security misconfigurations.
Vulnerability Detail
The vulnerability arises from the Node.js Permission Model's documentation, which does not clearly state that wildcards should only be used as the last character of a file path. For instance, using the command '--allow-fs-read=/home/node/.ssh/*.pub' incorrectly grants access to all files in the '.ssh/' directory instead of just the intended public key files. This misleading guidance can expose sensitive files to unauthorized access, affecting all users utilizing the experimental permission model in Node.js 20 and 21.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using wildcards in file paths when configuring the Node.js Permission Model. Instead, specify exact file paths to prevent unintended access. For example, use '--allow-fs-read=/home/node/.ssh/mykey.pub' instead of using wildcards.
Conclusion
In summary, CVE-2024-21890 highlights a significant documentation flaw in the Node.js Permission Model that can lead to security vulnerabilities. Users are encouraged to update their nodejs package to the latest version and avoid wildcard usage in file paths to protect sensitive data.
See every vulnerability recorded for nodejs →
FAQ
CVE-2024-21890 is a vulnerability in the Node.js Permission Model that misguides users on the use of wildcards in file paths, potentially leading to unauthorized access to sensitive files.
The vulnerability affects Node.js versions 20 and 21, specifically when using the experimental permission model.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.0, indicating a medium severity level.
If you cannot update the package, ensure to avoid using wildcards in your file path configurations to mitigate the risk of unauthorized access.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
