You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Repos under nodejs which do not include code, are not covered as they cannot lead to the threats listed.
59
61
pkgjs.org is excluded as it does not include code/repos that make it into Node.js binaries
@@ -86,6 +88,7 @@ or inderictly (builds process/testing)
86
88
|**nodejs/deps¹**| Write | If you have write access to Node.js dependencies you can hide malicious code and publish a new version, eventually the automation will create a PR to sync to nodejs/core and this code might pass without supervision |
87
89
|**nodejs/build** (GH) | - | N\A |
88
90
|**nodejs/node-core-utils**| Write | User must have _Write_ access to nodejs/node to open a attack vector|
91
+
|**nodejs/nodejs.org**| - | N\A |
89
92
|**npm account**| Write | Because you can change the node-core-utils/branch-diff code to inject malicious code |
90
93
|**Jenkins CI - test**| - | N\A |
91
94
|**Jenkins CI - release**| - | N\A |
@@ -99,3 +102,90 @@ or inderictly (builds process/testing)
99
102
|**Social media accounts**| - | N\A |
100
103
|**Email** (nodejs-sec) | - | N\A |
101
104
|**Email** (io.js aliases) | - | N\A |
105
+
106
+
### Malicious release binary generation in Node.js release/build processes
107
+
108
+
In this scenario we assume that a malicious actor will include a malicious code
109
+
(malware, malicious dependencies, polluted binaries...) in the release binaries
110
+
available through the Nodejs.org downloads.
111
+
112
+
**Vectors:**
113
+
114
+
* Use priviledge access to GitHub in order to add/modify/pollute the Git History
115
+
for the tooling/build repositories (like ansible scripts, etc..)
116
+
* Pollute directly machines that are part of the CI/release inventory used by
117
+
Jenkins/GH Actions
118
+
* Manipulate the CI/release pipelines in Jenkins or GH Actions (add/modify custom
"description": "Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash",
8
9
"overview": "An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.",
"description": "HTTP Request Smuggling via Content Length Obfuscation",
8
9
"overview": "The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.",
"overview": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\n\nNode.js Permission Model do not operate on file descriptors, however, operations such as `fs.fchown` or `fs.fchmod` can use a \"read-only\" file descriptor to change the owner and permissions of a file.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
"description": "Bypass incomplete fix of CVE-2024-27980",
8
9
"overview": "The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all possible extensions on Windows via `child_process.spawn` / `child_process.spawnSync`. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.\n\nThis vulnerability affects all users of `child_process.spawn` and `child_process.spawnSync` on Windows in all active release lines.",
"overview": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.lstat` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 22.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
"description": "Bypass network import restriction via data URL",
8
9
"overview": "A security flaw in Node.js allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\n\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\n\nExploiting this flaw can violate network import security, posing a risk to developers and servers.",
"description": "Permission model improperly processes UNC paths",
8
9
"overview": "The Permission Model assumes that any path starting with two backslashes \\\\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.\n\nThis vulnerability affects Windows users of the Node.js Permission Model in version v20.x and v22.x",
"overview": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \n\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23",
8
+
"description": "Worker permission bypass via InternalWorker leak in diagnostics",
9
+
"overview": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \n\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.",
0 commit comments