Corrective releases for the server-side JavaScript platform Node.js 21.6.2, 20.11.1, 18.19.1 are available, which fix 8 vulnerabilities, 4 of which have been assigned a high severity level:
- CVE-2024-21892 — the possibility for an unprivileged user to inject code that inherits the elevated privileges with which the process is executed. The vulnerability is caused by a flaw in the implementation of exceptions that allows environment variables set by an unprivileged user to be handled during a process with elevated privileges. The exception was meant to be granted only for the CAP_NET_BIND_SERVICE capabilities, but due to an error, it was applied to some other capabilities as well.
- CVE-2024-22019 — denial of service via exhaustion of available resources (CPU load and bandwidth consumption) when the built-in HTTP server handles specially crafted chunked requests, leading to reading an unlimited amount of bytes in a single connection.
- CVE-2024-21896 — directory traversal in file paths. The vulnerability allows bypassing file path normalization via path.resolve() when a path is passed using the Buffer class. After validation, the Buffer.from() method is called to obtain such a path, but an application may use Buffer.prototype.utf8Write, leading to content replacement at the stage after path.resolve() is executed, resulting in vulnerability.
- CVE-2024-22017 — the setuid() call did not drop all privileges. In particular, setuid() does not affect io_uring operations used in libuv if they were initialized before the setuid() call.
- CVE-2023-46809 — vulnerability in the privateDecrypt() API, allowing for a Marvin attack to decrypt RSA based on timing measurements of operations.
- CVE-2024-21891 — the possibility to bypass the access control model when using custom file path normalization handlers.
- CVE-2024-21890 — incorrect handling of masks in the parameters ‘—allow-fs-read’ and ‘—allow-fs-write’. For example, ‘—allow-fs-read=\/home\/node\/.ssh\/*.pub’ will grant access to all contents of ‘.ssh\/’, not just files with a ‘.pub’ extension, since the mask ‘*’ is handled as the last element of the path.
- CVE-2024-22025 — denial of service through resource exhaustion when decoding compressed Brotli data received via a fetch() call.
Additionally, it is worth noting the release of the libuv library 1.48.0, used in Node.js for connection multiplexing and asynchronous input/output processing. Besides Node.js, the library is also used in BIND 9 and Knot DNS DNS servers, H2O HTTP server, and the Lua framework Luvit. virtual machine MoarVM, the Julia language, and the Python framework uvloop. The new version fixes a vulnerability (CVE-2024-24806) that manifests in projects using libuv and allows for an SSRF (Server-side request forgery) attack to access internal APIs. This vulnerability arose from truncating the hostname by the uv_getaddrinfo() function to 256 characters before resolving the domain through the getaddrinfo() function, which can lead to misidentification and bypassing checks. an IP address For example, services like MySpace, which create subdomains in the format 'username.example.com', can be attacked by specifying a long username.
An update to the Node.js HTTP client undici 5.28.3 has also been released, which fixes a vulnerability (CVE-2024-24758) caused by the lack of clearing the Proxy-Authorization HTTP header when redirecting requests.
Source: opennet.ru
