CVE-2024-27933

HIGH EPSS 80.9%
Published Mar 21, 20242y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
High
Find Similar
Published Mar 21, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`, which returns a `IpcJsonStreamResource` ID associated with the file descriptor. On closing the resource, the raw file descriptor is closed together. Use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors. This allow standard input (fd 0) to be closed and re-opened for a different resource, which allows a silent permission prompt bypass. This is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable. There is a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions, additionally abusing the fact that Cache API lacks filesystem permission checks. The attack can be conducted silently as stderr can also be closed, suppressing all prompt outputs. Version 1.39.1 fixes the bug.

CVSS Details

Base Score
8.8
Exploitability
2.0
Impact
6.0
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
80.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

Affected Products 1

VendorProductVersionRange
denodeno1.39.0any

References 10

  • github.com https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L214
    Product
  • github.com https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L220
    Product
  • github.com https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L225
    Product
  • github.com https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L241
    Product
  • github.com https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L256
    Product
  • github.com https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L265
    Product
  • github.com https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L99
    Product
  • github.com https://github.com/denoland/deno/commit/55fac9f5ead6d30996400e8597c969b675c5a22b
    Patch
  • github.com https://github.com/denoland/deno/commit/5a91a065b882215dde209baf626247e54c21a392
    Product
  • github.com https://github.com/denoland/deno/security/advisories/GHSA-6q4w-9x56-rmwq
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/denoland/deno/commit/55fac9f5ead6d30996400e8597c969b675c5a22b
    Patch