CVE-2024-22018 is a low-severity vulnerability in Node.js versions 20 and 21, specifically impacting users of the experimental permission model when the --allow-fs-read flag is enabled. The flaw allows malicious actors to retrieve file statistics (fs.lstat) even without explicit read access, due to an inadequate permission model. This is a local attack with high attack complexity, resulting in a low impact on confidentiality. There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 20.0, < 20.15.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 22.0, < 22.4.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
nodejs: fs.lstat bypasses permission model
Jul 10, 2024A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Jul 9, 2024