PT-2024-22147 · Deno · Deno

Leesh3288 · Published 2024-03-06 · Updated 2025-01-03 · CVE-2024-27933

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deno version 1.39.0

Description The issue arises from the use of raw file descriptors in op node ipc pipe(), leading to the premature close of arbitrary file descriptors. This allows standard input to be closed and re-opened as a different resource, resulting in a permission prompt bypass. An attacker controlling the code executed inside a Deno runtime can exploit this to obtain arbitrary code execution on the host machine, regardless of permissions. The vulnerability is known to be exploitable, with a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions and abusing the lack of filesystem permission checks in the Cache API. The attack can be conducted silently as stderr can also be closed, suppressing all prompt outputs.

Recommendations To resolve the issue, update to Deno version 1.39.1, which fixes the bug. For version 1.39.0, as a temporary workaround, consider restricting the use of the op node ipc pipe() function until a patch is available. Additionally, be cautious when using the Cache API, as it lacks filesystem permission checks, which can be abused in conjunction with this vulnerability.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-27933

GHSA-6Q4W-9X56-RMWQ

Affected Products

Deno

References · 16

• 🔥 https://github.com/denoland/deno/security/advisories/GHSA-6q4w-9x56-rmwq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27933.json · Exploit
• https://github.com/denoland/deno/commit/55fac9f5ead6d30996400e8597c969b675c5a22b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-27933 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27933 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6q4w-9x56-rmwq · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L220 · Note
• https://github.com/denoland/deno/commit/5a91a065b882215dde209baf626247e54c21a392 · Note
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L99 · Note
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L265 · Note
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L241 · Note
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L225 · Note
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L214 · Note
• https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L256 · Note