CVE-2024-22020: Bypass network import restriction via data URL
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Other sources
Node.js could allow a remote attacker to execute arbitrary code on the system. By embedding non-network imports in data URLs, an attacker could exploit this vulnerability to bypass network import restrictions and execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.4Fixed in 20.15.1Fixed in 22.4.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.15.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.4.1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 20.15.1-r0 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 20.15.1+dfsg-1 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1 - Configuration
Forbid data URLs in network imports to mitigate the vulnerability.
Node.js network imports data URLs = forbidden
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-22020?
CVE-2024-22020 is considered a high-severity vulnerability due to its potential to allow attackers to execute arbitrary code.
How do I fix CVE-2024-22020?
To fix CVE-2024-22020, ensure data URLs are forbidden in network imports in affected software versions.
Which versions of IBM Planning Analytics are affected by CVE-2024-22020?
CVE-2024-22020 affects IBM Planning Analytics versions up to and including 2.1 and 2.0.
Can CVE-2024-22020 be exploited on all platforms?
Yes, CVE-2024-22020 has been verified to be exploitable on various platforms.
What is the main impact of CVE-2024-22020?
The main impact of CVE-2024-22020 is the compromise of system security through the execution of arbitrary code.