CVE-2024-21896: Path Traversal
Node.js could allow a remote attacker to traverse directories on the system. By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, an attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to read arbitrary files on the system.
Other sources
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21896?
CVE-2024-21896 has a high severity as it allows remote directory traversal, potentially exposing sensitive files.
Who is affected by CVE-2024-21896?
CVE-2024-21896 affects Node.js installations and IBM Cognos Analytics versions up to 12.0.3 and 11.2.4 FP3.
How do I fix CVE-2024-21896?
To fix CVE-2024-21896, update Node.js to version 20.11.1 and apply the relevant patches for affected Cognos Analytics versions.
What vulnerability does CVE-2024-21896 exploit?
CVE-2024-21896 exploits directory traversal vulnerabilities through manipulated Buffer internals in Node.js.
What can an attacker do with CVE-2024-21896?
An attacker can use CVE-2024-21896 to send crafted URL requests that read arbitrary files from the system.