CVE-2024-22018
First published: Wed Jul 10 2024(Updated: )
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Planning Analytics | <=2.1 | |
| IBM Planning Analytics | <=2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2024/07/11/6
- http://www.openwall.com/lists/oss-security/2024/07/19/3
- https://hackerone.com/reports/2145862
- https://access.redhat.com/errata/RHSA-2024:5815
- https://access.redhat.com/errata/RHSA-2024:5814
- https://bugzilla.redhat.com/show_bug.cgi?id=2296990
- https://www.ibm.com/support/pages/node/7168387 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-22018?
The severity of CVE-2024-22018 is categorized as medium due to its impact on the file permission model.
How do I fix CVE-2024-22018?
To fix CVE-2024-22018, users should avoid using the --allow-fs-read flag in Node.js or update to a patched version that addresses the vulnerability.
Who is affected by CVE-2024-22018?
CVE-2024-22018 specifically affects users of Node.js who utilize the experimental permission model and the --allow-fs-read flag.
What components are impacted by CVE-2024-22018?
CVE-2024-22018 impacts the fs.lstat API, allowing unauthorized access to file statistics.
Are there any workarounds for CVE-2024-22018?
A workaround for CVE-2024-22018 is to refrain from using the experimental permission model features until a fix is applied.
- agent/type
- agent/first-publish-date
- agent/author
- collector/nvd-api
- source/NVD
- agent/severity
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-22018
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/trending
- agent/source
- agent/tags
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm planning analytics
- version/ibm planning analytics/2.1
- version/ibm planning analytics/2.0