Path Traversal Vulnerability in Node.js Package: nodejs (CVE-2024-21891)
Summary
UBUNTU-CVE-2024-21891: Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through pat... Affects nodejs versions < 20.18.1+dfsg-1ubuntu2. Fixed in 20.18.1+dfsg-1ubuntu2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. It allows for the execution of JavaScript code server-side and is widely used for web development. The package 'nodejs' includes various tools and libraries for building server-side applications. However, it has been identified that the experimental permission model in Node.js versions 20 and 21 is susceptible to a path traversal vulnerability, which can lead to unauthorized access to the filesystem.
Vulnerability Detail
The vulnerability arises from Node.js's reliance on built-in utility functions to normalize paths for file system operations. These functions can be overridden by user-defined implementations, allowing attackers to bypass the filesystem permission model through path traversal attacks. This issue affects users utilizing the experimental permission model in Node.js 20 and 21, potentially leading to severe consequences such as unauthorized file access and data exposure.
How To Fix
Minimum fixed version
20.18.1+dfsg-1ubuntu2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the experimental permission model in your Node.js application until the package is updated. This can be done by avoiding the use of any features that rely on this model, thus mitigating the risk of exploitation.
Conclusion
In summary, CVE-2024-21891 is a critical vulnerability in the Node.js package that can lead to serious security risks through path traversal attacks. It is essential for users to update to the patched version to protect their applications from potential exploitation.
See every vulnerability recorded for nodejs →
FAQ
CVE-2024-21891 is a vulnerability in Node.js that allows for path traversal attacks due to the ability to override built-in path normalization functions.
The vulnerability affects Node.js versions 20 and 21 that utilize the experimental permission model.
The vulnerability can lead to unauthorized access to the filesystem, allowing attackers to read or modify sensitive files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 7.9, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
