Exposure of Sensitive Information to an Unauthorized Actor Affecting deno package, versions <1.44.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-DENO-7217831
- published 7 Jun 2024
- disclosed 6 Jun 2024
- credit Unknown
Introduced: 6 Jun 2024
CVE-2024-37150 Open this link in a new tabHow to fix?
Upgrade deno to version 1.44.1 or higher.
Overview
deno is an a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust.
Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor through the .npmrc support process. An attacker can intercept and misuse authentication tokens by exploiting the credential transmission to unintended domains.
Note: All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage.
Workaround
If your private registry ever serves tarballs at a different domain, rotate your registry credentials.