7.9

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-21891

CVE-2024-21891: Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs...

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-21891

CVE-2024-21891:

7.9

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2024-21891 arises from the ability to overwrite (monkey-patch) built-in JavaScript utility functions that are used by Node.js's node:fs module for path normalization, specifically when the experimental permission model is enabled. This allows an attacker to craft paths that bypass these permissions. Since direct access to the patch code (commit 96435a0538 / PR #51443) failed, the analysis relies on the vulnerability description. The functions that would appear in a runtime profile during exploitation are the public node:fs API functions (e.g., fs.open, fs.readFile, fs.writeFile, fs.stat, fs.mkdir, etc.) as these are the entry points that consume the user-provided paths. The underlying utility functions (like path.resolve or potentially String.prototype.normalize if used in the chain and overridable in a way that affects path logic) are the ones whose behavior is maliciously altered. The patch would involve ensuring that the fs module, particularly its permission model aspects (likely in lib/internal/fs/permission.js), uses pristine, non-overridden versions of these critical path normalization utilities. Confidence is 'medium' for fs functions as they are the direct interface, and 'low' to 'medium' for underlying utilities as their exact role in this specific CVE's exploitation path without the diff is inferential based on the general description of path normalization vulnerabilities.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.