CVE-2024-21896 Path traversal in Node
Attackers can bypass Node.js permission model path checks via Buffer monkey-patching, enabling path traversal in experimental features.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-21896?
CVE-2024-21896 is a high-severity path traversal vulnerability in Nodejs Node.js, published on 20 Feb 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Weakness: CWE-27
Which versions are affected by CVE-2024-21896?
2 open source packages ship an affected version, including node and node-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | From 20.0.0 | 20.12.0, 22.1.0 |
node-min Bitnami | From 20.0.0 | 20.18.1, 22.12.0 |
Products include Nodejs Node.js.
How do I fix CVE-2024-21896?
Upgrade node to a fixed version for your release line: 20.12.0 or 22.1.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-21896 being exploited?
There is no known exploitation of CVE-2024-21896 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as AZL-35053, BELL-CVE-2024-21896, BIT-node-2024-21896, BIT-node-min-2024-21896, GHSA-3q5r-g7hx-jv3c.