CVE-2024-36137 Security feature bypass in Node
Attackers can bypass Node.js permission model restrictions to modify file ownership and permissions using read-only file descriptors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36137?
CVE-2024-36137 is a low-severity vulnerability in NodeJS Node, published on 7 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Which versions are affected by CVE-2024-36137?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | From 20.0.0 | 20.15.1, 22.4.1 |
node-min Bitnami | From 20.0.0 | 20.18.1, 22.12.0 |
How do I fix CVE-2024-36137?
Upgrade node to a fixed version for your release line: 20.15.1 or 22.4.1.
Is CVE-2024-36137 being exploited?
There is no known exploitation of CVE-2024-36137 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2024-36137, AZL-48849, BELL-CVE-2024-36137, BIT-node-2024-36137, BIT-node-min-2024-36137, CLEANSTART-2026-DA49790 and 6 more.