CVE-2024-36137

2024-09-0716:15:02

hackerone

web.nvd.nist.gov

node.js

experimental permission model

vulnerability

fs.fchown

fs.fchmod

file descriptor

owner

permissions

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

6.6

Confidence

Low

EPSS

Percentile

9.5%

JSON

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.

Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a “read-only” file descriptor to change the owner and permissions of a file.

Affected configurations

Vulners

Node

nodejsnodeRange≤20.15.0

nodejsnodeRange≤22.4.0

VendorProductVersionCPE
nodejsnode*cpe:2.3:a:nodejs:node:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nodejs	node	*	cpe:2.3:a:nodejs:node::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "nodejs",
    "product": "node",
    "versions": [
      {
        "version": "20.15.0",
        "status": "affected",
        "lessThanOrEqual": "20.15.0",
        "versionType": "semver"
      },
      {
        "version": "22.4.0",
        "status": "affected",
        "lessThanOrEqual": "22.4.0",
        "versionType": "semver"
      }
    ]
  }
]