PT-2022-16876 · Deno · Deno

Aapoalas + 2 · Published 2022-03-25 · Updated 2023-06-30 · CVE-2022-24783

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno versions 1.18.0 through 1.20.2

Description The issue allows a malicious actor controlling the code executed in a Deno runtime to bypass all permission checks and execute arbitrary shell code. This does not affect users of Deno Deploy. The cause of this error was that certain FFI operations did not correctly check for permissions.

Recommendations For Deno versions 1.18.0 through 1.20.2, upgrade to Deno 1.20.3 immediately, as this version includes the patch for the issue. There is no workaround for this issue, so upgrading is the recommended course of action.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2022-24783

GHSA-838H-JQP6-CF2F

Affected Products

Deno

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24783.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-24783 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24783 · Security Note
• https://osv.dev/vulnerability/GHSA-838h-jqp6-cf2f · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f · Note
• https://github.com/denoland/deno/pull/14115 · Note
• https://github.com/denoland/deno/compare/v1.20.2...v1.20.3 · Note
• https://github.com/denoland/deno/commit/fcfce1bb869fddc629e6d889d6ba1328b80b0dcf · Note
• https://github.com/denoland/deno/releases/tag/v1.20.3 · Note
• https://t.me/cvenotify/53426 · Telegram Post