SB2024070937 - Multiple vulnerabilities in Node.js

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Command Injection (CVE-ID: CVE-2024-36138)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper handling of batch files in child_process.spawn / child_process.spawnSync on Windows. An attacker can inject a malicious command line argument and achieve code execution even if the shell option is not enabled.

Note, the vulnerability exists due to incomplete fix for #VU88462 (CVE-2024-27980).

2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-22020)

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input when handling non-network imports in data URLs. A remote user can bypass network import restrictions and execute arbitrary code.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-36137)

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to application does not properly impose security restrictions in the experimental permission model when the --allow-fs-write flag is used. A remote user can change file ownership and permissions via fs.fchown and fs.fchmod.

4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-22018)

The vulnerability allows a remote user to bypass permissions model.

The vulnerability exists due to application does not properly impose security restrictions when experimental permission model when the --allow-fs-read flag is used. A remote user can retrieve stats from files that they do not have explicit read access to.

5) Input validation error (CVE-ID: CVE-2024-37372)

The vulnerability allows a remote user to bypass permissions model.

The vulnerability exists due to insufficient validation of UNC paths with backslashes. A remote user can bypass certain security restrictions.

Remediation

Install update from vendor's website.

References

• https://nodejs.org/en/blog/vulnerability/july-2024-security-releases
• https://hackerone.com/reports/2092749