| Name | CVE-2024-22020 |
| Description | A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| nodejs (PTS) | jessie | 0.10.29~dfsg-2 | fixed |
| stretch | 4.8.2~dfsg-1 | fixed | |
| buster (security), buster, buster (lts) | 10.24.0~dfsg-1~deb10u4 | fixed | |
| bullseye | 12.22.12~dfsg-1~deb11u4 | fixed | |
| bullseye (security) | 12.22.12~dfsg-1~deb11u5 | fixed | |
| bookworm | 18.19.0+dfsg-6~deb12u2 | vulnerable | |
| bookworm (security) | 18.19.0+dfsg-6~deb12u1 | vulnerable | |
| trixie | 20.18.0+dfsg-2 | fixed | |
| sid | 20.18.1+dfsg-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| nodejs | source | jessie | (not affected) | |||
| nodejs | source | stretch | (not affected) | |||
| nodejs | source | buster | (not affected) | |||
| nodejs | source | bullseye | (not affected) | |||
| nodejs | source | (unstable) | 20.15.1+dfsg-1 |
[bullseye] - nodejs <not-affected> (Feature was introduced in NodeJS 18)
https://nodejs.org/en/blog/vulnerability/july-2024-security-releases#bypass-network-import-restriction-via-data-url-cve-2024-22020---medium
https://hackerone.com/reports/2092749
Fixed by: https://github.com/nodejs/node/commit/60e184a6e414e5bc9624acf87433fc4052260116 (v20.15.1)
Experimental HTTPS and HTTP imports was introduced in 18 see https://nodejs.org/en/blog/announcements/v18-release-announce
[buster] - nodejs <not-affected> (Vulnerable code is not present)
[stretch] - nodejs <not-affected> (Vulnerable code is not present)
[jessie] - nodejs <not-affected> (Vulnerable code is not present)