Path Traversal Vulnerability in Node.js Package - CVE-2024-21896
Summary
UBUNTU-CVE-2024-21896: The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. Affects nodejs versions 20.16.0+dfsg-1ubuntu1 – 20.18.1+dfsg-1ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected package, nodejs version 20.18.1+dfsg-1ubuntu2, includes an experimental permission model designed to enhance security. However, this model is susceptible to a path traversal vulnerability, which can be exploited if not addressed.
Vulnerability Detail
The vulnerability arises from the permission model's reliance on path.resolve() to protect against path traversal attacks. If a user-supplied path is treated as a Buffer, the implementation uses Buffer.from() to create a Buffer from the resolved path. By monkey-patching Buffer internals, specifically Buffer.prototype.utf8Write, an attacker can manipulate the output of path.resolve(), leading to unauthorized access to files outside the intended directory. This vulnerability affects all users utilizing the experimental permission model in Node.js 20 and 21, potentially allowing attackers to read sensitive files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the experimental permission model in Node.js until the vulnerability is patched. Additionally, ensure that user-supplied paths are validated and sanitized before processing.
Conclusion
The CVE-2024-21896 vulnerability in the Node.js package presents a significant risk due to its potential for path traversal attacks. Users are advised to update their packages promptly and consider workarounds until a full resolution is implemented. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for nodejs →
FAQ
CVE-2024-21896 is a path traversal vulnerability in the Node.js package that affects versions 20 and 21, allowing attackers to manipulate file paths.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive files on the server, posing significant security risks.
Yes, a patched version of the nodejs package is available. Updating to the latest version will resolve the issue.
If immediate updates are not possible, consider disabling the experimental permission model and validating user inputs to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
