CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization
Node.js could allow a remote attacker to bypass security restrictions, caused by improper path traversal sequence sanitization. By using a path traversal attack, an attacker could exploit this vulnerability leading to filesystem permission model bypass.
Other sources
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack.
— Node.Js
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwritten with user-defined implementations leading to filesystem permission model bypass through path traversal attack.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 20.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.11.1Fixed in 21.6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.6.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-21891?
CVE-2024-21891 is classified as a high severity vulnerability due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2024-21891?
To mitigate CVE-2024-21891, update Node.js to version 20.11.1 or apply the relevant patches for IBM Cognos Analytics.
What types of attacks can exploit CVE-2024-21891?
CVE-2024-21891 can be exploited through path traversal attacks, allowing unauthorized access to files in the system.
Which software is affected by CVE-2024-21891?
CVE-2024-21891 affects Node.js and specific versions of IBM Cognos Analytics.
What is the impact of CVE-2024-21891?
The impact of CVE-2024-21891 includes potential unauthorized access to the filesystem, compromising the security of the application.