CVE-2021-22921 Incorrect Permission Assignment for Critical Resource in Node

What is CVE-2021-22921?

CVE-2021-22921 is a high-severity vulnerability in Nodejs Node.js, published on 12 Jul 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

Weakness: CWE-732

Which versions are affected by CVE-2021-22921?

2 open source packages ship an affected version, including node and node-min. It affects 2 products.

Products include Nodejs Node.js, Siemens Sinec Infrastructure Network Services.

How do I fix CVE-2021-22921?

Upgrade node to a fixed version for your release line: 12.22.2, 14.17.2 or 16.4.1.

Is CVE-2021-22921 being exploited?

There is no known exploitation of CVE-2021-22921 in the wild and no public exploit code.

Other vulnerabilities in Nodejs Node.js

• CVE-2023-32002 Security feature bypass in Node Critical 9.8
• CVE-2016-6303 Integer overflow in n/a Critical 9.8
• CVE-2017-15896 Security feature bypass in Node.js Critical 9.1
• CVE-2018-7160 Server-side request forgery in Node.js High 8.8
• CVE-2018-12120 Misconfiguration in Node.js High 8.1

All Nodejs Node.js vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-node-2021-22921, BIT-node-min-2021-22921, GHSA-g3w9-g82h-cmp4.