GHSA-vc52-gwm3-8v2f CVE-2023-33966
Missing "--allow-net" permission check for built-in Node modules
- Severity
- 8.6 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.62%
- Chance of exploitation in the next 30 days. Higher than 49.99% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
- Available
- 2 packages have a fixed version
Description
Impact
Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (--allow-net). Dependencies relying on these built-in modules are subject to the vulnerability too.
Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected.
Patches
This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version.
Workarounds
No workaround is available for this issue.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| deno | >= 1.34.0, < 1.34.1 |
1.34.1 |
| deno_runtime | >= 0.114.0, < 0.115.0 |
0.115.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
deno crates.io → 1.34.1
- cargo
cargo update -p deno --precise 1.34.1
deno_runtime crates.io → 0.115.0
- cargo
cargo update -p deno_runtime --precise 0.115.0
Severity breakdown
CVSS 3.1 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
- Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it
- Architecture and Design, Operation: The architecture needs to access and modification attributes for files to only those users who actually require those actions.
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-x2qc-cmh9-f4hf Deno: Denial of service via non-ASCII bytes in WebSocket response headers | Medium | Also affects deno |
| GHSA-8xpq-cjcf-3wh9 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) | High | Also affects deno |
| GHSA-968w-xfqw-vp9q Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions | Medium | Also affects deno |
| GHSA-v8fw-85r8-5m23 Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks | Medium | Also affects deno |
| GHSA-9xg4-qhm4-g43w Deno: Miller-Rabin Primality Test Allows Zero Rounds | High | Also affects deno |
| GHSA-7xh3-mhg9-jcw8 Deno: Command Injection via spawnSync & spawn on Windows | High | Also affects deno |
| GHSA-4c8g-jvcx-v4hv Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access | Medium | Also affects deno |
| GHSA-83pc-3rw9-qpwj Deno: WebSocket API sandbox bypass via missing post-DNS check | Medium | Also affects deno |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor