PT-2024-35445 · Deno · Deno Standard Library

Lionel-Rowe · Published 2024-11-22 · Updated 2024-11-22 · CVE-2024-52793

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Deno Standard Library versions prior to 1.0.11

Description The issue affects the Deno Standard Library, specifically the http/file-server module's serveDir function when used with the showDirListing: true option. This setup is vulnerable to cross-site scripting attacks when an attacker can control file names in the source directory, particularly on systems that use POSIX file names. Although exploitation might be possible on other systems, it is less straightforward due to differences in file name support, such as the lack of support for <> in Windows file names.

Recommendations For Deno Standard Library versions prior to 1.0.11, update to version 1.0.11 to resolve the issue. As a temporary workaround, consider setting showDirListing to false in the serveDir function to minimize the risk of exploitation. Restrict access to the http/file-server module, especially for users who can control file names in the source directory, until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-52793

GHSA-32FX-H446-H8PF

Affected Products

Deno Standard Library

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52793.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52793 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52793 · Vendor Advisory
• https://github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/file_server.ts#L532 · Note
• https://github.com/denoland/std/security/advisories/GHSA-32fx-h446-h8pf · Note
• https://github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/file_server.ts#L507 · Note
• https://twitter.com/CVEnew/status/1859988078019940555 · Twitter Post