CVE-2024-21890

What it actually does

Misleading documentation in the experimental Node.js permission model causes wildcard patterns not ending the path (e.g., /home/node/.ssh/*.pub) to be treated as granting access to all files under the parent directory instead of restricting to the intended suffix.

Why it matters to the business

Organizations relying on the permission model for least-privilege file access in Node.js applications may inadvertently expose sensitive directories, increasing the risk of unauthorized data access in development or production workloads that adopt the experimental feature.

How an attack unfolds

An administrator configures file-system permissions using a wildcard pattern based on the unclear documentation; the runtime ignores the wildcard suffix and grants broader read or write access; a local or compromised process then reads or modifies files beyond the intended scope.

How to fix it

Upgrade to a build containing commit 3eccdd1ae61777a381a7ac3bc0ea62443dbb50b8 or later; update documentation examples to place wildcards only as the final character; avoid using the experimental permission model until it exits experimental status if strict file controls are required.

How to confirm the fix worked

Confirm the installed Node.js binary or source contains commit 3eccdd1ae61777a381a7ac3bc0ea62443dbb50b8; test permission grants with both terminating and non-terminating wildcard patterns to verify intended scoping behavior.

Typical attack path

1. Review Node.js permission model documentation and copy an example wildcard pattern that does not terminate the path.
2. Apply the pattern via --allow-fs-read or similar flags when starting a Node.js process.
3. The permission model interprets the pattern as granting access to the entire parent directory.
4. A process running under those permissions accesses files outside the intended set.

How to detect it

Search process launch logs and container or service startup scripts for --allow-fs-read or --allow-fs-write flags containing wildcard characters that are not the final path element; review permission model configuration files or deployment manifests for similar patterns.

What your security team should do

• Prioritize upgrade to the fixed commit for any environments using the permission model.
• Audit existing permission flag configurations for non-terminating wildcards and replace them with explicit paths or correct wildcard usage.
• Disable the experimental permission model in production until it is stable.
• Monitor upstream Node.js releases for further permission model changes.