CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
Other sources
Node.js could allow a local attacker to gain elevated privileges on the system, caused by improper configuration of permissions in the installation directory. Under certain conditions. An attacker could exploit this vulnerability to perform PATH and DLL hijacking attacks.
— IBM
Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921
All versions of the 16.x, 14.x, and 12.x releases lines
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.2Fixed in 14.17.2Fixed in 16.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.17.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.4.1 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 16.4.1 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 14.17.2 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 12.22.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22921?
CVE-2021-22921 is a vulnerability in Node.js that could allow a local attacker to gain elevated privileges on the system.
How does CVE-2021-22921 work?
CVE-2021-22921 is caused by improper configuration of permissions in the installation directory of Node.js, which can be exploited by a local attacker to perform PATH and DLL hijacking attacks.
What is the severity of CVE-2021-22921?
CVE-2021-22921 has a severity rating of high, with a CVSS score of 7.4.
How can CVE-2021-22921 be exploited?
CVE-2021-22921 can be exploited by a local attacker who has access to the installation directory of Node.js, allowing them to manipulate the PATH environment variable and potentially execute malicious code.
Is there a fix for CVE-2021-22921?
To fix CVE-2021-22921, it is recommended to update Node.js to the latest version and ensure proper configuration of permissions in the installation directory.