CVE-2024-21890: Medium severity ibm cognos analytics vulnerability
Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of wildcards in --allow-fs-read and --allow-fs-write. An attacker could exploit this vulnerability to gain access to the system.
Other sources
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub
will ignore pub and give access to everything after .ssh/.
This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— NVD
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/.
Impacts: This misleading documentation affects all users using the experimental permission model in active release lines: 20.x and 21.x.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21890?
CVE-2024-21890 has been rated as a high severity vulnerability due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2024-21890?
To fix CVE-2024-21890, update Node.js to version 20.11.1 or apply the relevant patches from IBM for Cognos Analytics.
What versions of Node.js are affected by CVE-2024-21890?
CVE-2024-21890 affects versions of Node.js prior to 20.11.1.
What types of attacks can exploit CVE-2024-21890?
CVE-2024-21890 can be exploited by remote attackers to gain unauthorized access to the system due to improper handling of wildcards.
Is there documentation clarifying the Node.js Permission Model related to CVE-2024-21890?
The Node.js Permission Model lacks clear documentation regarding the handling of permission flags, which is part of the problem outlined in CVE-2024-21890.