PT-2024-27335 · Deno · Deno

Bartlomieju · Published 2024-06-06 · Updated 2024-12-17 · CVE-2024-37150

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Deno version 1.44.0

Description An issue in .npmrc support was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this issue if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage.

Recommendations To resolve the issue, upgrade to Deno 1.44.1. If your private registry ever serves tarballs at a different domain, rotate your registry credentials. As a temporary workaround, consider restricting access to the .npmrc file to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-706

CWE-200

Related Identifiers

CVE-2024-37150

GHSA-RFC6-H225-3VXV

Affected Products

Deno

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37150.json · Exploit
• https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxv · Vendor Advisory
• https://github.com/denoland/deno/commit/566adb7c0a0c0845e90a6e867a2c0ef5d2ada575 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-37150 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37150 · Vendor Advisory
• https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-scoped-registry%22 · Note
• https://t.me/cvenotify/82293 · Telegram Post
• https://t.me/cvenotify/82192 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1798786503901900847 · Twitter Post
• https://twitter.com/linuxpatch/status/1798763953897787493 · Twitter Post
• https://twitter.com/CVEnew/status/1798741395202572562 · Twitter Post
• https://twitter.com/technews4869/status/1822922568468136390 · Twitter Post
• https://twitter.com/liran_tal/status/1869095387404898466 · Twitter Post
• https://t.me/cvenotify/96117 · Telegram Post
• https://twitter.com/liran_tal/status/1824369724177711128 · Twitter Post