CVE-2024-22018

What it actually does

The experimental permission model fails to enforce read restrictions on fs.lstat, allowing retrieval of file metadata (size, timestamps, permissions) for paths outside the explicitly allowed set when --allow-fs-read is active.

Why it matters to the business

Attackers can enumerate file existence, sizes, and modification times on protected paths, enabling reconnaissance that may support targeted follow-on attacks or information leakage without triggering read denials.

How an attack unfolds

An attacker runs or supplies code to a Node.js process started with the experimental permission model and --allow-fs-read; the code calls fs.lstat on arbitrary paths that were never granted read access, bypassing the intended restriction and receiving stat results.

How to fix it

Disable the experimental permission model in production Node.js 20/21 deployments or remove the --allow-fs-read flag; monitor Node.js release notes for a fix in subsequent versions and upgrade once available.

How to confirm the fix worked

Audit application startup flags and permission configuration; attempt fs.lstat calls against paths outside the allow list in a test environment and confirm that metadata is no longer returned.

Typical attack path

1. Start or compromise a Node.js process using the experimental permission model with --allow-fs-read
2. Identify or guess paths outside the permitted read set
3. Invoke fs.lstat (or equivalent) on those paths
4. Receive and inspect returned file metadata

How to detect it

Search process command lines and configuration for the experimental permission model and --allow-fs-read flags; review application source and dependency code for direct or indirect fs.lstat usage against untrusted paths.

What your security team should do

• Do not enable the experimental permission model on production systems until the authorization gap is resolved
• Replace --allow-fs-read usage with stricter process isolation or container-level controls
• Review any Node.js 20/21 services for permission-model usage and schedule upgrades once patched releases ship