Cloudanix VulnDB

CVE-2024-21892

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Feb 20, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Node.js lets regular users run their code with higher system powers than they should have on Linux systems.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Privilege Gain
Component
Application
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Node.js on Linux fails to properly ignore environment variables set by unprivileged users when the process has certain Linux capabilities beyond CAP_NET_BIND_SERVICE, allowing code injection with elevated privileges.

Why it matters to the business

Attackers can gain elevated privileges on systems running Node.js with capabilities, potentially leading to unauthorized access or control over services; high ecosystem prevalence increases exposure across dependent applications.

How an attack unfolds

An unprivileged user sets malicious environment variables before a Node.js process starts with elevated capabilities; due to the flawed exception handling, the injected code executes inheriting those privileges, enabling privilege escalation.

How to fix it

Upgrade Node.js to a version containing commit 3eccdd1ae61777a381a7ac3bc0ea62443dbb50b8 or later; review and restrict use of Linux capabilities on Node.js processes.

How to confirm the fix worked

Verify Node.js binary or source includes commit 3eccdd1ae61777a381a7ac3bc0ea62443dbb50b8; test by setting environment variables as a non-privileged user and confirming they are ignored under elevated capabilities.

Typical attack path

  1. Identify a Node.js process running with Linux capabilities beyond CAP_NET_BIND_SERVICE
  2. Set malicious environment variables as an unprivileged user
  3. Trigger execution of the Node.js process that loads the environment variables
  4. Execute injected code that inherits and abuses the elevated privileges

How to detect it

Inspect process listings and environment for Node.js instances running with unexpected capabilities; review logs for anomalous environment variable usage or privilege transitions during Node.js startup.

What your security team should do

  • Immediately update all Node.js installations to the fixed commit 3eccdd1ae61777a381a7ac3bc0ea62443dbb50b8
  • Audit and minimize Linux capabilities granted to Node.js processes
  • Implement least-privilege execution environments for Node.js services

The record

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 nodejs 0 1:18.19.1-1.module_el8.9.0+3753+4de0891b
AlmaLinux:8 nodejs 0 1:20.11.1-1.module_el8.9.0+3775+d8460d35
AlmaLinux:8 nodejs-devel 0 1:18.19.1-1.module_el8.9.0+3753+4de0891b
AlmaLinux:8 nodejs-devel 0 1:20.11.1-1.module_el8.9.0+3775+d8460d35
AlmaLinux:8 nodejs-docs 0 1:18.19.1-1.module_el8.9.0+3753+4de0891b
AlmaLinux:8 nodejs-docs 0 1:20.11.1-1.module_el8.9.0+3775+d8460d35
AlmaLinux:8 nodejs-full-i18n 0 1:18.19.1-1.module_el8.9.0+3753+4de0891b
AlmaLinux:8 nodejs-full-i18n 0 1:20.11.1-1.module_el8.9.0+3775+d8460d35
AlmaLinux:8 nodejs-nodemon 0 3.0.1-1.module_el8.8.0+3613+1ed8c91d
AlmaLinux:8 nodejs-nodemon 0 3.0.1-1.module_el8.9.0+3731+490e3ce5
AlmaLinux:8 nodejs-packaging 0 2021.06-4.module_el8.7.0+3343+ea2b7901
AlmaLinux:8 nodejs-packaging 0 2021.06-4.module_el8.9.0+3684+11b9e959
AlmaLinux:8 nodejs-packaging-bundler 0 2021.06-4.module_el8.7.0+3343+ea2b7901
AlmaLinux:8 nodejs-packaging-bundler 0 2021.06-4.module_el8.9.0+3684+11b9e959
AlmaLinux:8 npm 0 1:10.2.4-1.18.19.1.1.module_el8.9.0+3753+4de0891b
AlmaLinux:8 npm 0 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35
AlmaLinux:9 nodejs 0 1:18.19.1-1.module_el9.3.0+59+28b95644
AlmaLinux:9 nodejs 0 1:20.11.1-1.module_el9.3.0+88+29afeaa2
AlmaLinux:9 nodejs-devel 0 1:18.19.1-1.module_el9.3.0+59+28b95644
AlmaLinux:9 nodejs-devel 0 1:20.11.1-1.module_el9.3.0+88+29afeaa2
AlmaLinux:9 nodejs-docs 0 1:18.19.1-1.module_el9.3.0+59+28b95644
AlmaLinux:9 nodejs-docs 0 1:20.11.1-1.module_el9.3.0+88+29afeaa2
AlmaLinux:9 nodejs-full-i18n 0 1:18.19.1-1.module_el9.3.0+59+28b95644
AlmaLinux:9 nodejs-full-i18n 0 1:20.11.1-1.module_el9.3.0+88+29afeaa2
AlmaLinux:9 nodejs-nodemon 0 3.0.1-1.module_el9.2.0+36+853e48f5
AlmaLinux:9 nodejs-nodemon 0 3.0.1-1.module_el9.3.0+47+c33bc288
AlmaLinux:9 nodejs-packaging 0 2021.06-4.module_el9.1.0+13+d9a595ea
AlmaLinux:9 nodejs-packaging 0 2021.06-4.module_el9.3.0+48+1cf146a1
AlmaLinux:9 nodejs-packaging-bundler 0 2021.06-4.module_el9.1.0+13+d9a595ea
AlmaLinux:9 nodejs-packaging-bundler 0 2021.06-4.module_el9.3.0+48+1cf146a1
AlmaLinux:9 npm 0 1:10.2.4-1.18.19.1.1.module_el9.3.0+59+28b95644
AlmaLinux:9 npm 0 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2
Bitnami node 0 18.19.1
Bitnami node 21.0.0 21.6.2
Bitnami node-min 0 18.19.1
Bitnami node-min 21.0.0 21.6.2
Chainguard nodejs-16 0 16.20.2-r16
Chainguard nodejs-16-doc 0 16.20.2-r15
Debian:12 nodejs 0 No fix
Debian:13 nodejs 0 18.19.1+dfsg-1
Debian:14 nodejs 0 18.19.1+dfsg-1
Mageia:9 nodejs 0 18.19.1-1.mga9
Mageia:9 yarnpkg 0 1.22.21-0.10.2.4.1.mga9
Red Hat:enterprise_linux:8::appstream nodejs 0 1:18.19.1-1.module+el8.9.0+21387+21356dec
Red Hat:enterprise_linux:8::appstream nodejs 0 1:20.11.1-1.module+el8.9.0+21380+12032667
Red Hat:enterprise_linux:8::appstream nodejs-debuginfo 0 1:18.19.1-1.module+el8.9.0+21387+21356dec
Red Hat:enterprise_linux:8::appstream nodejs-debuginfo 0 1:20.11.1-1.module+el8.9.0+21380+12032667
Red Hat:enterprise_linux:8::appstream nodejs-debugsource 0 1:18.19.1-1.module+el8.9.0+21387+21356dec
Red Hat:enterprise_linux:8::appstream nodejs-debugsource 0 1:20.11.1-1.module+el8.9.0+21380+12032667
Red Hat:enterprise_linux:8::appstream nodejs-devel 0 1:18.19.1-1.module+el8.9.0+21387+21356dec
Red Hat:enterprise_linux:8::appstream nodejs-devel 0 1:20.11.1-1.module+el8.9.0+21380+12032667
Red Hat:enterprise_linux:8::appstream nodejs-docs 0 1:18.19.1-1.module+el8.9.0+21387+21356dec
Red Hat:enterprise_linux:8::appstream nodejs-docs 0 1:20.11.1-1.module+el8.9.0+21380+12032667
Red Hat:enterprise_linux:8::appstream nodejs-full-i18n 0 1:18.19.1-1.module+el8.9.0+21387+21356dec
Red Hat:enterprise_linux:8::appstream nodejs-full-i18n 0 1:20.11.1-1.module+el8.9.0+21380+12032667
Red Hat:enterprise_linux:8::appstream nodejs-nodemon 0 0:3.0.1-1.module+el8.9.0+21190+5ebd2c33
Red Hat:enterprise_linux:8::appstream nodejs-nodemon 0 0:3.0.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs-packaging 0 0:2021.06-4.module+el8.9.0+21190+5ebd2c33
Red Hat:enterprise_linux:8::appstream nodejs-packaging 0 0:2021.06-4.module+el8.9.0+19519+e25b965a
Red Hat:enterprise_linux:8::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el8.9.0+21190+5ebd2c33
Red Hat:enterprise_linux:8::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el8.9.0+19519+e25b965a
Red Hat:enterprise_linux:8::appstream npm 0 1:10.2.4-1.18.19.1.1.module+el8.9.0+21387+21356dec
Red Hat:enterprise_linux:8::appstream npm 0 1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667
Red Hat:enterprise_linux:9::appstream nodejs 0 1:18.19.1-1.module+el9.3.0+21388+22892fb9
Red Hat:enterprise_linux:9::appstream nodejs 0 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
Red Hat:enterprise_linux:9::appstream nodejs-debuginfo 0 1:18.19.1-1.module+el9.3.0+21388+22892fb9
Red Hat:enterprise_linux:9::appstream nodejs-debuginfo 0 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
Red Hat:enterprise_linux:9::appstream nodejs-debugsource 0 1:18.19.1-1.module+el9.3.0+21388+22892fb9
Red Hat:enterprise_linux:9::appstream nodejs-debugsource 0 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
Red Hat:enterprise_linux:9::appstream nodejs-devel 0 1:18.19.1-1.module+el9.3.0+21388+22892fb9
Red Hat:enterprise_linux:9::appstream nodejs-devel 0 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
Red Hat:enterprise_linux:9::appstream nodejs-docs 0 1:18.19.1-1.module+el9.3.0+21388+22892fb9
Red Hat:enterprise_linux:9::appstream nodejs-docs 0 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
Red Hat:enterprise_linux:9::appstream nodejs-full-i18n 0 1:18.19.1-1.module+el9.3.0+21388+22892fb9
Red Hat:enterprise_linux:9::appstream nodejs-full-i18n 0 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
Red Hat:enterprise_linux:9::appstream nodejs-nodemon 0 0:3.0.1-1.module+el9.3.0+19762+d716bf3b
Red Hat:enterprise_linux:9::appstream nodejs-nodemon 0 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781
Red Hat:enterprise_linux:9::appstream nodejs-packaging 0 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9::appstream nodejs-packaging 0 0:2021.06-4.module+el9.3.0+19518+63aad52d
Red Hat:enterprise_linux:9::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el9.3.0+19518+63aad52d
Red Hat:enterprise_linux:9::appstream npm 0 1:10.2.4-1.18.19.1.1.module+el9.3.0+21388+22892fb9
Red Hat:enterprise_linux:9::appstream npm 0 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a
Red Hat:rhel_eus:8.8::appstream nodejs 0 1:18.19.1-1.module+el8.8.0+21592+14a8b93e
Red Hat:rhel_eus:8.8::appstream nodejs-debuginfo 0 1:18.19.1-1.module+el8.8.0+21592+14a8b93e
Red Hat:rhel_eus:8.8::appstream nodejs-debugsource 0 1:18.19.1-1.module+el8.8.0+21592+14a8b93e
Red Hat:rhel_eus:8.8::appstream nodejs-devel 0 1:18.19.1-1.module+el8.8.0+21592+14a8b93e
Red Hat:rhel_eus:8.8::appstream nodejs-docs 0 1:18.19.1-1.module+el8.8.0+21592+14a8b93e
Red Hat:rhel_eus:8.8::appstream nodejs-full-i18n 0 1:18.19.1-1.module+el8.8.0+21592+14a8b93e
Red Hat:rhel_eus:8.8::appstream nodejs-nodemon 0 0:3.0.1-1.module+el8.8.0+19757+8ca87034
Red Hat:rhel_eus:8.8::appstream nodejs-packaging 0 0:2021.06-4.module+el8.7.0+15582+19c314fa
Red Hat:rhel_eus:8.8::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el8.7.0+15582+19c314fa
Red Hat:rhel_eus:8.8::appstream npm 0 1:10.2.4-1.18.19.1.1.module+el8.8.0+21592+14a8b93e
Red Hat:rhel_eus:9.2::appstream nodejs 0 1:18.19.1-1.module+el9.2.0+21594+a052107e
Red Hat:rhel_eus:9.2::appstream nodejs-debuginfo 0 1:18.19.1-1.module+el9.2.0+21594+a052107e
Red Hat:rhel_eus:9.2::appstream nodejs-debugsource 0 1:18.19.1-1.module+el9.2.0+21594+a052107e
Red Hat:rhel_eus:9.2::appstream nodejs-devel 0 1:18.19.1-1.module+el9.2.0+21594+a052107e
Red Hat:rhel_eus:9.2::appstream nodejs-docs 0 1:18.19.1-1.module+el9.2.0+21594+a052107e
Red Hat:rhel_eus:9.2::appstream nodejs-full-i18n 0 1:18.19.1-1.module+el9.2.0+21594+a052107e
Red Hat:rhel_eus:9.2::appstream nodejs-nodemon 0 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0
Red Hat:rhel_eus:9.2::appstream nodejs-packaging 0 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:rhel_eus:9.2::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:rhel_eus:9.2::appstream npm 0 1:10.2.4-1.18.19.1.1.module+el9.2.0+21594+a052107e
Rocky Linux:8 nodejs 0 1:18.19.1-1.module+el8.9.0+1768+6b454dc0
Rocky Linux:8 nodejs 0 1:20.11.1-1.module+el8.9.0+1776+addd4aec
Rocky Linux:8 nodejs-nodemon 0 0:3.0.1-1.module+el8.8.0+1459+02651ab6
Rocky Linux:8 nodejs-packaging 0 0:2021.06-4.module+el8.7.0+1072+5b168780
Rocky Linux:9 nodejs-nodemon 0 0:3.0.1-1.module+el9.2.0+15226+de336927
Rocky Linux:9 nodejs-nodemon 0 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01
Rocky Linux:9 nodejs-packaging 0 0:2021.06-4.module+el9.2.0+15226+de336927
Rocky Linux:9 nodejs-packaging 0 0:2021.06-4.module+el9.5.0+31770+0da7192d
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS nodejs18 0 18.19.1-150400.9.18.2
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS nodejs18 0 18.19.1-150400.9.18.2
SUSE:Linux Enterprise Module for Web and Scripting 12 nodejs18 0 18.19.1-8.18.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 nodejs18 0 18.19.1-150400.9.18.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 nodejs20 0 20.11.1-150500.11.6.1
SUSE:Linux Enterprise Server 15 SP4-LTSS nodejs18 0 18.19.1-150400.9.18.2
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 nodejs18 0 18.19.1-150400.9.18.2
SUSE:Manager Server 4.3 nodejs18 0 18.19.1-150400.9.18.2
Ubuntu:20.04:LTS nodejs 0 No fix
Ubuntu:22.04:LTS nodejs 0 No fix
Ubuntu:24.04:LTS nodejs 0 No fix
Ubuntu:Pro:14.04:LTS nodejs 0 No fix
Ubuntu:Pro:16.04:LTS nodejs 0 No fix
Ubuntu:Pro:18.04:LTS nodejs 0 No fix
Wolfi nodejs-16 0 16.20.2-r16
Wolfi nodejs-16-doc 0 16.20.2-r15
openSUSE:Leap 15.5 nodejs18 0 18.19.1-150400.9.18.2
openSUSE:Leap 15.5 nodejs20 0 20.11.1-150500.11.6.1
openSUSE:Tumbleweed nodejs20 0 20.11.1-1.1
openSUSE:Tumbleweed nodejs21 0 21.6.2-1.1

Related vulnerabilities