Directory Traversal Affecting nodejs:20/nodejs package, versions <1:20.11.1-1.module+el9.3.0+21385+bac43d5a


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Directory Traversal vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL9-NODEJS-7879108
  • published3 Sept 2024
  • disclosed19 Feb 2024

Introduced: 19 Feb 2024

CVE-2024-21896  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade RHEL:9 nodejs:20/nodejs to version 1:20.11.1-1.module+el9.3.0+21385+bac43d5a or higher.
This issue was patched in RHSA-2024:1688.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs:20/nodejs package and not the nodejs:20/nodejs package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS Scores

version 3.1