PT-2024-20594 · Node.Js+1 · Node.Js+1

Tomibelan · Published 2024-02-09 · Updated 2024-02-16 · CVE-2024-24828

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions pkg (affected versions not specified)

Description The issue arises from the pkg tool writing native code packages to a hardcoded directory, specifically /tmp/pkg/* on Unix systems, which is a shared directory for all users on the same local system. The package names within this directory are predictable and lack uniqueness, allowing an attacker with access to the same local system to replace genuine executables with malicious ones of the same name. A user may then unknowingly run the malicious executable. The pkg package is deprecated, and as a result, no patch will be provided for this issue. Users are advised to transition to actively maintained alternatives, such as investigating Node.js 21's support for single executable applications.

Recommendations To check if your executable built by pkg depends on native code and is vulnerable, run the executable and check if /tmp/pkg/ was created. Users should transition to actively maintained alternatives. Investigate Node.js 21’s support for single executable applications. Prioritize migrating to other packages that offer similar functionality with enhanced security. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-24828

GHSA-22R3-9W55-CJ54

Affected Products

Node.Js

Pkg

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24828.json · Exploit
• https://github.com/vercel/pkg/security/advisories/GHSA-22r3-9w55-cj54 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24828 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24828 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-22r3-9w55-cj54 · Vendor Advisory
• https://github.com/vercel/pkg · Note
• https://t.me/cvenotify/71712 · Telegram Post
• https://nodejs.org/api/single-executable-applications.html · Note
• https://twitter.com/VulmonFeeds/status/1756127490064445520 · Twitter Post
• https://twitter.com/CVEnew/status/1756083189724934594 · Twitter Post