PT-2024-24595 · Deno · Deno

Nekzor · Published 2024-11-25 · Updated 2024-11-25 · CVE-2024-32468

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Deno versions prior to 1.41.1

Description The issue concerns several cross-site scripting vulnerabilities in the deno doc crate, leading to Self-XSS when using deno doc --html. Specifically, there are two vulnerabilities:

1. The generated search index.js file uses innerHTML on unsanitized HTML input, and
2. the deno doc component does not sanitize property names, method names, and enum names. The first vulnerability likely has minimal impact since deno doc --html is typically used locally with personal packages.

Recommendations For Deno versions prior to 1.41.1, upgrade to a version newer than 1.41.1 to mitigate the risk. As a temporary workaround, consider restricting the use of the deno doc --html command until a patch is applied. Avoid using the deno doc component with unsanitized input until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-32468

GHSA-QQWR-J9MM-FHW6

Affected Products

Deno

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32468.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32468 · Security Note
• https://osv.dev/vulnerability/GHSA-qqwr-j9mm-fhw6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32468 · Vendor Advisory
• https://github.com/denoland/deno · Note
• https://github.com/denoland/deno/security/advisories/GHSA-qqwr-j9mm-fhw6 · Note
• https://github.com/denoland/deno_doc/blob/dc556c848831d7ae48f3eff2ababc6e75eb6b73e/src/html/templates/pages/search.js#L120-L144 · Note
• https://github.com/denoland/deno_doc/commit/0f1ef3efbf16194730a29d93dcb9c02f6c490942 · Note
• https://twitter.com/CVEnew/status/1861121478424674586 · Twitter Post
• https://twitter.com/oktsec/status/1861162457667928382 · Twitter Post