PT-2023-24607 · Deno · Eden Runtime+1

Sylc · Published 2023-05-31 · Updated 2023-06-07 · CVE-2023-33966

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Deno versions 1.34.0 deno runtime versions 0.114.0

Description The issue affects outbound HTTP requests made using the built-in node:http or node:https modules, which are incorrectly not checked against the network permission allow list (--allow-net). Dependencies relying on these built-in modules are also subject to the issue.

Recommendations For Deno version 1.34.0, update to Deno v1.34.1. For deno runtime version 0.114.0, update to deno runtime 0.114.1.

Exploit

Fix

Incorrect Default Permissions

Improper Privilege Management

Weakness Enumeration

CWE-276

CWE-269

Related Identifiers

CVE-2023-33966

GHSA-VC52-GWM3-8V2F

Affected Products

Deno

Eden Runtime

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33966.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33966 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33966 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vc52-gwm3-8v2f · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/releases/tag/v1.34.1 · Note