Description

CVE-2024-21891 is a critical vulnerability in Node.js that allows attackers to bypass the filesystem permission model through a path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. The SVRS for this vulnerability is 30, indicating a moderate level of severity.

Key Insights

• This vulnerability is actively exploited in the wild, meaning that attackers are actively using it to target systems.
• The vulnerability is caused by a flaw in the way that Node.js handles path normalization, which can allow attackers to overwrite built-in utility functions with user-defined implementations.
• This vulnerability can be used to gain unauthorized access to files and directories on the target system.

Mitigation Strategies

• Update to Node.js version 22 or later, which includes a fix for this vulnerability.
• Disable the experimental permission model in Node.js 20 and Node.js 21.
• Implement input validation and sanitization to prevent attackers from providing malicious input that could trigger this vulnerability.
• Monitor systems for suspicious activity and take appropriate action if any suspicious activity is detected.

Additional Information

• The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about this vulnerability, calling for immediate and necessary measures.
• If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.