Node.js Permission Model Path Traversal via Buffer Prototype MonkeyPatch
CVE-2024-21896 Published on February 20, 2024
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Weakness Type
Path Traversal: 'dir/../../filename'
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
Products Associated with CVE-2024-21896
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-21896 are published in nodejs node.js:
Affected Versions
NodeJS Node:- Version 4.0 and below 4.* is affected.
- Version 5.0 and below 5.* is affected.
- Version 6.0 and below 6.* is affected.
- Version 7.0 and below 7.* is affected.
- Version 8.0 and below 8.* is affected.
- Version 9.0 and below 9.* is affected.
- Version 10.0 and below 10.* is affected.
- Version 11.0 and below 11.* is affected.
- Version 12.0 and below 12.* is affected.
- Version 13.0 and below 13.* is affected.
- Version 14.0 and below 14.* is affected.
- Version 15.0 and below 15.* is affected.
- Version 16.0 and below 16.* is affected.
- Version 17.0 and below 17.* is affected.
- Version 19.0 and below 19.* is affected.
- Version 20.0 and below 20.11.1 is affected.
- Version 21.0 and below 21.6.2 is affected.
- Version 21.6.1 is affected.
- Version 20.11.0 is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.