CVE-2024-21890: node.js (CVSS 6.5)

Description

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Is your site exposed to CVE-2024-21890?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions
nodejs	node.js	20.0.0 — 20.11.1
nodejs	node.js	21.0.0 — 21.6.2

References

Other References

http://www.openwall.com/lists/oss-security/2024/03/11/1 https://hackerone.com/reports/2257156 https://security.netapp.com/advisory/ntap-20240315-0002/ http://www.openwall.com/lists/oss-security/2024/03/11/1 https://hackerone.com/reports/2257156 https://security.netapp.com/advisory/ntap-20240315-0002/

Frequently Asked Questions

What is CVE-2024-21890? +

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-21890? +

CVE-2024-21890 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-21890? +

CVE-2024-21890 affects products from nodejs, specifically: node.js. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-21890? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-3566 9.8

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess …

CVE-2026-48930 9.8

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string …

CVE-2024-21896 9.8

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If …

CVE-2024-21891 8.8

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined …

CVE-2024-21892 7.8

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process …

CVE-2024-22019 7.5

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading …

CVE-2024-21890