setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

An update of the nodejs package has been released.

The version of Tenable.ad installed on the remote host is prior to 3.59.5. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-11 advisory.

  - The POLY1305 MAC (message authentication code) implementation contains a bug that might     corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64     processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the     OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application     state might be corrupted with various application dependent consequences. The POLY1305 MAC (message     authentication code) implementation in OpenSSL does not save the contents of non-volatile XMM registers on     Windows 64 platform when calculating the MAC of data larger than 64 bytes. Before returning to the caller     all the XMM registers are set to zero rather than restoring their previous content. The vulnerable code is     used only on newer x86_64 processors supporting the AVX512-IFMA instructions. The consequences of this     kind of internal application state corruption can be various - from no consequences, if the calling     application does not depend on the contents of non-volatile XMM registers at all, to the worst     consequences, where the attacker could get complete control of the application process. However given the     contents of the registers are just zeroized so the attacker cannot put arbitrary values inside, the most     likely consequence, if any, would be an incorrect result of some application dependent calculations or a     crash leading to a denial of service. The POLY1305 MAC algorithm is most frequently used as part of the     CHACHA20-POLY1305 AEAD (authenticated encryption with associated data) algorithm. The most common usage of     this AEAD cipher is with TLS protocol versions 1.2 and 1.3 and a malicious client can influence whether     this AEAD cipher is used by the server. This implies that server applications using OpenSSL can be     potentially impacted. However we are currently not aware of any concrete application that would be     affected by this issue therefore we consider this a Low severity security issue. As a workaround the     AVX512-IFMA instructions support can be disabled at runtime by setting the environment variable     OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000 The FIPS provider is not affected by this issue.
    (CVE-2023-4807)

  - Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into     an endless loop during decompression of Brotli data with extra input. (CVE-2024-32976)

  - Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector     from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
    (CVE-2024-34364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nodejs18 / nodejs / libuv installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-22017 advisory.

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). This vulnerability affects all users using version greater or equal than     Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. (CVE-2024-22017)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a431676c-f86c-4371-b48a-b7d2b0bec3a3 advisory.

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). This vulnerability affects all users using version greater or equal than     Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. (CVE-2024-22017)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1688 advisory.

  - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore     `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using     the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was     issued, the permission model is an experimental feature of Node.js. (CVE-2024-21890)

  - Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack. This vulnerability affects all users using the experimental permission     model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model     is an experimental feature of Node.js. (CVE-2024-21891)

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability. This vulnerability affects all users using the experimental permission model in     Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an     experimental feature of Node.js. (CVE-2024-21896)

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). This vulnerability affects all users using version greater or equal than     Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. (CVE-2024-22017)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:1687 advisory.

  - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore     `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using     the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was     issued, the permission model is an experimental feature of Node.js. (CVE-2024-21890)

  - Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack. This vulnerability affects all users using the experimental permission     model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model     is an experimental feature of Node.js. (CVE-2024-21891)

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability. This vulnerability affects all users using the experimental permission model in     Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an     experimental feature of Node.js. (CVE-2024-21896)

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). This vulnerability affects all users using version greater or equal than     Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. (CVE-2024-22017)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1687 advisory.

  - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore     `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using     the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was     issued, the permission model is an experimental feature of Node.js. (CVE-2024-21890)

  - Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack. This vulnerability affects all users using the experimental permission     model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model     is an experimental feature of Node.js. (CVE-2024-21891)

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability. This vulnerability affects all users using the experimental permission model in     Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an     experimental feature of Node.js. (CVE-2024-21896)

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). This vulnerability affects all users using version greater or equal than     Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. (CVE-2024-22017)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1688 advisory.

  - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore     `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using     the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was     issued, the permission model is an experimental feature of Node.js. (CVE-2024-21890)

  - Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack. This vulnerability affects all users using the experimental permission     model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model     is an experimental feature of Node.js. (CVE-2024-21891)

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability. This vulnerability affects all users using the experimental permission model in     Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an     experimental feature of Node.js. (CVE-2024-21896)

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). This vulnerability affects all users using version greater or equal than     Node.js 18.18.0, Node.js 20.4.0 and Node.js 21. (CVE-2024-22017)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1688 advisory.

    - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 (high)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1687 advisory.

    - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 (high)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1687 advisory.

    Node.js is a software development platform for building fast and scalable     network applications in the JavaScript programming language.

    Security Fix(es):

    * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)     (CVE-2023-46809)

    * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (CVE-2024-22019)

    * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)

    * nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)

    * nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization     (CVE-2024-21891)

    * nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)

    * nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1688 advisory.

    Node.js is a software development platform for building fast and scalable     network applications in the JavaScript programming language.

    Security Fix(es):

    * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)     (CVE-2023-46809)

    * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (CVE-2024-22019)

    * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)

    * nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)

    * nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization     (CVE-2024-21891)

    * nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)

    * nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-544 advisory.

  - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore     `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using     the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was     issued, the permission model is an experimental feature of Node.js. (CVE-2024-21890)

  - Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack. This vulnerability affects all users using the experimental permission     model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model     is an experimental feature of Node.js. (CVE-2024-21891)

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability. This vulnerability affects all users using the experimental permission model in     Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an     experimental feature of Node.js. (CVE-2024-21896)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization     headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been     patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for     this vulnerability. (CVE-2024-24758)

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). Impacts: Thank you, to valette for reporting this vulnerability and thank you     Tobias Nieen for fixing it. (CVE-2024-22017)

  - 2024-03-13: CVE-2024-22025 was added to this advisory. (CVE-2024-22025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 77a6f1c9-d7d2-11ee-bb12-001b217b3468 advisory.

  - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore     `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using     the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was     issued, the permission model is an experimental feature of Node.js. (CVE-2024-21890)

  - Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack. This vulnerability affects all users using the experimental permission     model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model     is an experimental feature of Node.js. (CVE-2024-21891)

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability. This vulnerability affects all users using the experimental permission model in     Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an     experimental feature of Node.js. (CVE-2024-21896)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). Impacts: Thank you, to valette for reporting this vulnerability and thank you     Tobias Nieen for fixing it. (CVE-2024-22017)

  -  Denial of Service by resource exhaustion in fetch() brotli decoding. (CVE-2024-22025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0643-1 advisory.

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

  - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore     `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using     the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was     issued, the permission model is an experimental feature of Node.js. (CVE-2024-21890)

  - Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack. This vulnerability affects all users using the experimental permission     model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model     is an experimental feature of Node.js. (CVE-2024-21891)

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. (CVE-2024-21892)

  - The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability. This vulnerability affects all users using the experimental permission model in     Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an     experimental feature of Node.js. (CVE-2024-21896)

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). Impacts: Thank you, to valette for reporting this vulnerability and thank you     Tobias Nieen for fixing it. (CVE-2024-22017)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

  - Node.js reports: Code injection and privilege escalation through Linux capabilities- (High) http: Reading     unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) Path traversal by     monkey-patching Buffer internals- (High) setuid() does not drop all privileges due to io_uring - (High)     Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1     v1.5 padding) - (Medium) Multiple permission model bypasses due to improper path traversal sequence     sanitization - (Medium) Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)     Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) (CVE-2024-22025)

  - Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization     headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been     patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for     this vulnerability. (CVE-2024-24758)

  - libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function     in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to     256 characters before calling `getaddrinfo`. This behavior can be exploited to create addresses like     `0x00007f000001`, which are considered valid by `getaddrinfo` and could allow an attacker to craft     payloads that resolve to unintended IP addresses, bypassing developer checks. The vulnerability arises due     to how the `hostname_ascii` variable (with a length of 256 bytes) is handled in `uv_getaddrinfo` and     subsequently in `uv__idna_toascii`. When the hostname exceeds 256 characters, it gets truncated without a     terminating null byte. As a result attackers may be able to access internal APIs or for websites (similar     to MySpace) that allows users to have `username.example.com` pages. Internal services that crawl or cache     these user pages can be exposed to SSRF attacks if a malicious user chooses a long vulnerable username.
    This issue has been addressed in release version 1.48.0. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2024-24806)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 18.19.1, 20.11.1, 21.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday February 14 2024 Security Releases advisory.

  - On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user     while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due     to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when     certain other capabilities have been set. This allows unprivileged users to inject code that inherits the     process's elevated privileges. Impacts: Thank you, to Tobias Nieen for reporting this vulnerability and     for fixing it. (CVE-2024-21892)

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. Impacts: Thank you, to Bartek Nowotarski for reporting this vulnerability     and thank you Paolo Insogna for fixing it. (CVE-2024-22019)

  - The permission model protects itself against path traversal attacks by calling path.resolve() on any paths     given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to     obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely,     Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path     traversal vulnerability. Impacts: Please note that at the time this CVE was issued, the permission model     is an experimental feature of Node.js. Thank you, to Tobias Nieen for reporting this vulnerability and     for fixing it. (CVE-2024-21896)

  - setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
    This allows the process to perform privileged operations despite presumably having dropped such privileges     through a call to setuid(). Impacts: Thank you, to valette for reporting this vulnerability and thank you     Tobias Nieen for fixing it. (CVE-2024-22017)

  - A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel     during PKCS#1 v1.5 padding error handling. The vulnerability revealed significant timing differences in     decryption for valid and invalid ciphertexts. This poses a serious threat as attackers could remotely     exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios     involving API endpoints processing Json Web Encryption messages. Impacts: Thank you, to hkario for     reporting this vulnerability and thank you Michael Dawson for fixing it. (CVE-2023-46809)

  - Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions,     which can be overwitten with user-defined implementations leading to filesystem permission model bypass     through path traversal attack. Impacts: Please note that at the time this CVE was issued, the permission     model is an experimental feature of Node.js. Thank you, to xion for reporting this vulnerability and thank     you Rafael Gonzaga for fixing it. (CVE-2024-21891)

  - The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as     the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/*.pub will ignore pub and     give access to everything after .ssh/. Impacts: Please note that at the time this CVE was issued, the     permission model is an experimental feature of Node.js. Thank you, to Tobias Nieen for reporting this     vulnerability and thank you Rafael Gonzaga for fixing it. (CVE-2024-21890)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204476	Photon OS 5.0: Nodejs PHSA-2024-5.0-0213	Nessus	PhotonOS Local Security Checks	high
201946	Tenable.ad < 3.59.5 Multiple Vulnerabilities (TNS-2024-11)	Nessus	Misc.	high
201257	CBL Mariner 2.0 Security Update: nodejs18 / nodejs / libuv (CVE-2024-22017)	Nessus	MarinerOS Local Security Checks	high
197493	FreeBSD : electron29 -- setuid() does not affect libuv's internal io_uring (a431676c-f86c-4371-b48a-b7d2b0bec3a3)	Nessus	FreeBSD Local Security Checks	high
195012	Rocky Linux 9 : nodejs:20 (RLSA-2024:1688)	Nessus	Rocky Linux Local Security Checks	high
195000	Rocky Linux 8 : nodejs:20 (RLSA-2024:1687)	Nessus	Rocky Linux Local Security Checks	high
193169	AlmaLinux 8 : nodejs:20 (ALSA-2024:1687)	Nessus	Alma Linux Local Security Checks	high
193158	AlmaLinux 9 : nodejs:20 (ALSA-2024:1688)	Nessus	Alma Linux Local Security Checks	high
193030	Oracle Linux 9 : nodejs:20 (ELSA-2024-1688)	Nessus	Oracle Linux Local Security Checks	high
193028	Oracle Linux 8 : nodejs:20 (ELSA-2024-1687)	Nessus	Oracle Linux Local Security Checks	high
192973	RHEL 8 : nodejs:20 (RHSA-2024:1687)	Nessus	Red Hat Local Security Checks	high
192970	RHEL 9 : nodejs:20 (RHSA-2024:1688)	Nessus	Red Hat Local Security Checks	high
191606	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-544)	Nessus	Amazon Linux Local Security Checks	high
191471	FreeBSD : NodeJS -- Vulnerabilities (77a6f1c9-d7d2-11ee-bb12-001b217b3468)	Nessus	FreeBSD Local Security Checks	high
191130	SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2024:0643-1)	Nessus	SuSE Local Security Checks	high
190856	Node.js 18.x < 18.19.1 / 20.x < 20.11.1 / 21.x < 21.6.2 Multiple Vulnerabilities (Wednesday February 14 2024 Security Releases).	Nessus	Misc.	high

Detections

Analytics

CVE-2024-22017

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high