CVE-2024-21892

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers a rich library of various JavaScript modules and is widely used in server-side applications.

‍

An Improper Privilege Management vulnerability has been identified in Node.js. The issue stems from a bug in the implementation of privilege exceptions. This weakness allows attackers to inject code that inherits the process's elevated privileges.

‍

This vulnerability affects specific versions of the package and can result in unauthorized access. Details on affected versions and reproduction steps are provided below.

‍

Details

Module Info

• ‍Affected packages: Node.js‍
• Affected versions: 4.0 < 18.19.1, 20 < 20.11.1 ‍
• GitHub repository: https://github.com/nodejs/node‍
• Published packages: https://github.com/nodejs/node/releases‍
• Package manager: npm‍
• Fixed in: Node.js NES version 12, 14, 16
  

‍

Vulnerability Info

The issue stems from a bug in the implementation of privilege exceptions.

For instance, in a scenario where Node.js is running with elevated privileges, if `CAP_NET_BIND_SERVICE` environment variable is set by an unprivileged user, the system incorrectly applies privilege. This behavior can be exploited by attackers to execute arbitrary code with elevated privileges.

‍

This vulnerability is a result of flawed logic, and may allow attackers to escalate privileges.

- https://www.cve.org/CVERecord?id=CVE-2024-21892

- https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/03-Testing_for_Privilege_Escalation

‍

Mitigation

This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.

- Update to a patched LTS version of Node.js

- Leverage a commercial support partner like HeroDevs for post-EOL security.

Refer to the NES documentation for upgrade instructions.

‍

Credits

• tniessen