CVE-2024-21896: Path traversal by monkey-patching Buffer internals
Node.js could allow a remote attacker to traverse directories on the system. By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, an attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to read arbitrary files on the system.
Other sources
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve().
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 20.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.11.1Fixed in 21.6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.6.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-21896?
CVE-2024-21896 has a high severity as it allows remote directory traversal, potentially exposing sensitive files.
Who is affected by CVE-2024-21896?
CVE-2024-21896 affects Node.js installations and IBM Cognos Analytics versions up to 12.0.3 and 11.2.4 FP3.
How do I fix CVE-2024-21896?
To fix CVE-2024-21896, update Node.js to version 20.11.1 and apply the relevant patches for affected Cognos Analytics versions.
What vulnerability does CVE-2024-21896 exploit?
CVE-2024-21896 exploits directory traversal vulnerabilities through manipulated Buffer internals in Node.js.
What can an attacker do with CVE-2024-21896?
An attacker can use CVE-2024-21896 to send crafted URL requests that read arbitrary files from the system.