PT-2021-15277 · Node.Js · Node.Js

Deepsurface-Robert + 1 · Published 2021-07-12 · Updated 2024-12-16 · CVE-2021-22921

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 16.4.1 Node.js versions prior to 14.17.2 Node.js versions prior to 12.22.2

Description The issue allows for local privilege escalation attacks under certain conditions on Windows platforms due to improper configuration of permissions in the installation directory. This can lead to two different escalation attacks: PATH and DLL hijacking.

Recommendations For versions prior to 16.4.1, update to version 16.4.1 or later. For versions prior to 14.17.2, update to version 14.17.2 or later. For versions prior to 12.22.2, update to version 12.22.2 or later.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BIT-NODE-2021-22921

BIT-NODE-MIN-2021-22921

CVE-2021-22921

OESA-2022-1620

Affected Products

Node.Js

References · 21

• 🔥 https://hackerone.com/reports/1211160 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-22921 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21824 · Security Note
• https://nodejs.org/en/blog/vulnerability/july-2021-security-releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39134 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-15366 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-27290 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44531 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-3450 · Security Note
• https://osv.dev/vulnerability/BIT-node-2021-22921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22960 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44533 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22959 · Security Note