CVE-2023-33966: Deno missing "--allow-net" permission check for built-in Node modules
Impact
Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (--allow-net). Dependencies relying on these built-in modules are subject to the vulnerability too.
Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected.
Patches
This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version.
Workarounds
No workaround is available for this issue.
Other sources
Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and denoruntime 0.114.0, outbound HTTP requests made using the built-in node:http or node:https modules are incorrectly not checked against the network permission allow list (--allow-net). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and denoruntime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/deno_runtimeto a version that resolves this vulnerability.Fixed in 0.115.0 - Upgrade
Upgrade
rust/denoto a version that resolves this vulnerability.Fixed in 1.34.1 - Upgrade
Upgrade
Denoto a version that resolves this vulnerability.Fixed in 1.34.1 - Upgrade
Upgrade
deno_runtimeto a version that resolves this vulnerability.Fixed in 0.114.1
Event History
Frequently Asked Questions
What is the impact of CVE-2023-33966?
Outbound HTTP requests made using the built-in node:http or node:https modules in Deno 1.34.0 and deno_runtime 0.114.0 are incorrectly not checked against the network permission allow list.
What is the severity of CVE-2023-33966?
The severity of CVE-2023-33966 is critical with a CVSS score of 9.8.
How can I fix CVE-2023-33966?
To fix CVE-2023-33966, update Deno to version 1.34.1 or later and deno_runtime to version 0.115.0 or later.
Where can I find more information about CVE-2023-33966?
You can find more information about CVE-2023-33966 on the Deno GitHub Security Advisory page (https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f) and the NVD (National Vulnerability Database) page (https://nvd.nist.gov/vuln/detail/CVE-2023-33966).