CVE-2024-22020

NameCVE-2024-22020
DescriptionA security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nodejs (PTS)jessie0.10.29~dfsg-2fixed
stretch4.8.2~dfsg-1fixed
buster (security), buster, buster (lts)10.24.0~dfsg-1~deb10u4fixed
bullseye12.22.12~dfsg-1~deb11u4fixed
bullseye (security)12.22.12~dfsg-1~deb11u5fixed
bookworm18.19.0+dfsg-6~deb12u2vulnerable
bookworm (security)18.19.0+dfsg-6~deb12u1vulnerable
sid, trixie20.17.0+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nodejssourcejessie(not affected)
nodejssourcestretch(not affected)
nodejssourcebuster(not affected)
nodejssourcebullseye(not affected)
nodejssource(unstable)20.15.1+dfsg-1

Notes

[bullseye] - nodejs <not-affected> (Feature was introduced in NodeJS 18)
https://nodejs.org/en/blog/vulnerability/july-2024-security-releases#bypass-network-import-restriction-via-data-url-cve-2024-22020---medium
https://hackerone.com/reports/2092749
Fixed by: https://github.com/nodejs/node/commit/60e184a6e414e5bc9624acf87433fc4052260116 (v20.15.1)
Experimental HTTPS and HTTP imports was introduced in 18 see https://nodejs.org/en/blog/announcements/v18-release-announce
[buster] - nodejs <not-affected> (Vulnerable code is not present)
[stretch] - nodejs <not-affected> (Vulnerable code is not present)
[jessie] - nodejs <not-affected> (Vulnerable code is not present)

Search for package or bug name: Reporting problems