PT-2022-11451 · Deno · Deno

Masasrono · Published 2022-06-12 · Updated 2022-06-21 · CVE-2021-41641

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Deno versions 1.14.0 and earlier

Description The issue concerns the file sandbox in Deno not handling symbolic links correctly. When Deno is run with specific write access, the Deno.symlink method can be exploited to gain access to any directory.

Recommendations For Deno versions 1.14.0 and earlier, as a temporary workaround, consider disabling the Deno.symlink method until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2021-41641

GHSA-67HM-27MX-9CG7

Affected Products

Deno

References · 8

• 🔥 https://github.com/denoland/deno/issues/12152 · Exploit
• 🔥 https://hackers.report/report/614876917a7b150012836bb8 · Exploit
• https://osv.dev/vulnerability/CVE-2021-41641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41641 · Security Note
• https://osv.dev/vulnerability/GHSA-67hm-27mx-9cg7 · Vendor Advisory
• https://github.com/denoland/deno/pull/12554 · Note
• https://github.com/denoland/deno/commit/d44011a69e0674acfa9c59bd7ad7f0523eb61d42 · Note
• https://t.me/cibsecurity/44241 · Telegram Post