CVE-2024-22020
Published: July 9, 2024Last modified: November 5, 2024
Description
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack Vector | LOCAL |
| Attack complexity | HIGH |
| Privileges required | NONE |
| User interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality | LOW |
| Integrity impact | HIGH |
| Availability impact | HIGH |
| Vector | CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | nodejs | Fixed (18.20.4-r0) |
| Stream | nodejs | Fixed (20.15.1-r0) | |
| Liberica NIK | 23 (JDK 17) | standard (nodejs) | Fixed (23.0.6+1) |
| 23 (JDK 21) | standard (nodejs) | Fixed (23.1.5+1) | |
| 24 (JDK 23) | nodejs | Fixed (24.1.1+1) |
References
- http://www.openwall.com/lists/oss-security/2024/07/11/6
- http://www.openwall.com/lists/oss-security/2024/07/19/3
- https://hackerone.com/reports/2092749
- https://security.netapp.com/advisory/ntap-20241122-0006/