CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write
Improper handling of wildcards in --allow-fs-read and --allow-fs-write
Other sources
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path.
For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— Node.Js
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub
will ignore pub and give access to everything after .ssh/.
This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— MITRE
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/.
Impacts: This misleading documentation affects all users using the experimental permission model in active release lines: 20.x and 21.x.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 20.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.11.1Fixed in 21.6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.6.2 - Configuration
Update permission-model arguments so wildcards in --allow-fs-read and --allow-fs-write appear only as the final character; do not use patterns such as --allow-fs-read=/home/node/.ssh/*.pub.
Node.js Permission Model --allow-fs-read and --allow-fs-write wildcard usage = Use wildcards only as the last character of a file path
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-21890?
CVE-2024-21890 has been rated as a high severity vulnerability due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2024-21890?
To fix CVE-2024-21890, update Node.js to version 20.11.1 or apply the relevant patches from IBM for Cognos Analytics.
What versions of Node.js are affected by CVE-2024-21890?
CVE-2024-21890 affects versions of Node.js prior to 20.11.1.
What types of attacks can exploit CVE-2024-21890?
CVE-2024-21890 can be exploited by remote attackers to gain unauthorized access to the system due to improper handling of wildcards.
Is there documentation clarifying the Node.js Permission Model related to CVE-2024-21890?
The Node.js Permission Model lacks clear documentation regarding the handling of permission flags, which is part of the problem outlined in CVE-2024-21890.