Cloudanix VulnDB

CVE-2024-22020

Medium · 6.5

CVSS

6.5

EPSS

1.1%

Published

Jul 9, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in software used by developers lets attackers sneak in and run their own code on computers and servers by tricking import rules.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
High
Impact
Full Compromise
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits bypassing network import restrictions in Node.js by embedding non-network imports inside data URLs, enabling arbitrary code execution that violates intended security boundaries.

Why it matters to the business

Attackers can execute unauthorized code on developer workstations and servers, leading to potential system compromise, data exposure, and operational disruption for organizations using affected packages.

How an attack unfolds

An attacker crafts a malicious data URL containing non-network imports, supplies it to a network import mechanism, and triggers execution of arbitrary code that bypasses restrictions.

How to fix it

Upgrade drush (Bitnami) to version 9.2.18 or later to enforce the mitigation that forbids data URLs in network imports.

How to confirm the fix worked

Confirm the installed package version is at least 9.2.18 and test that data URLs are rejected in network import contexts.

Typical attack path

  1. Identify an application or dependency using vulnerable Node.js import handling
  2. Craft a data URL embedding non-network imports
  3. Deliver the payload through a network import call
  4. Trigger execution to bypass restrictions and run arbitrary code

How to detect it

Examine application logs and import-related error messages for unexpected data URL usage; review process execution and network activity around import calls for signs of unauthorized code paths.

What your security team should do

  • Apply the fixed version 9.2.18 immediately across all instances
  • Review and restrict use of dynamic imports in applications
  • Monitor for any post-fix anomalies in import behavior

The record

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 nodejs 0 1:20.16.0-1.module_el8.10.0+3882+e12e42db
AlmaLinux:8 nodejs 0 1:18.20.4-1.module_el8.10.0+3890+5a092792
AlmaLinux:8 nodejs-devel 0 1:20.16.0-1.module_el8.10.0+3882+e12e42db
AlmaLinux:8 nodejs-devel 0 1:18.20.4-1.module_el8.10.0+3890+5a092792
AlmaLinux:8 nodejs-docs 0 1:20.16.0-1.module_el8.10.0+3882+e12e42db
AlmaLinux:8 nodejs-docs 0 1:18.20.4-1.module_el8.10.0+3890+5a092792
AlmaLinux:8 nodejs-full-i18n 0 1:20.16.0-1.module_el8.10.0+3882+e12e42db
AlmaLinux:8 nodejs-full-i18n 0 1:18.20.4-1.module_el8.10.0+3890+5a092792
AlmaLinux:8 nodejs-nodemon 0 3.0.1-1.module_el8.9.0+3731+490e3ce5
AlmaLinux:8 nodejs-nodemon 0 3.0.1-1.module_el8.8.0+3613+1ed8c91d
AlmaLinux:8 nodejs-packaging 0 2021.06-4.module_el8.9.0+3775+d8460d35
AlmaLinux:8 nodejs-packaging 0 2021.06-4.module_el8.7.0+3343+ea2b7901
AlmaLinux:8 nodejs-packaging-bundler 0 2021.06-4.module_el8.9.0+3775+d8460d35
AlmaLinux:8 nodejs-packaging-bundler 0 2021.06-4.module_el8.7.0+3343+ea2b7901
AlmaLinux:8 npm 0 1:10.8.1-1.20.16.0.1.module_el8.10.0+3882+e12e42db
AlmaLinux:8 npm 0 1:10.7.0-1.18.20.4.1.module_el8.10.0+3890+5a092792
AlmaLinux:9 nodejs 0 1:20.16.0-1.module_el9.4.0+107+dbd477e4
AlmaLinux:9 nodejs 0 1:18.20.4-1.module_el9.4.0+112+bb28ff81
AlmaLinux:9 nodejs-devel 0 1:20.16.0-1.module_el9.4.0+107+dbd477e4
AlmaLinux:9 nodejs-devel 0 1:18.20.4-1.module_el9.4.0+112+bb28ff81
AlmaLinux:9 nodejs-docs 0 1:20.16.0-1.module_el9.4.0+107+dbd477e4
AlmaLinux:9 nodejs-docs 0 1:18.20.4-1.module_el9.4.0+112+bb28ff81
AlmaLinux:9 nodejs-full-i18n 0 1:20.16.0-1.module_el9.4.0+107+dbd477e4
AlmaLinux:9 nodejs-full-i18n 0 1:18.20.4-1.module_el9.4.0+112+bb28ff81
AlmaLinux:9 nodejs-nodemon 0 3.0.1-1.module_el9.3.0+47+c33bc288
AlmaLinux:9 nodejs-nodemon 0 3.0.1-1.module_el9.2.0+36+853e48f5
AlmaLinux:9 nodejs-packaging 0 2021.06-4.module_el9.3.0+88+29afeaa2
AlmaLinux:9 nodejs-packaging 0 2021.06-4.module_el9.1.0+13+d9a595ea
AlmaLinux:9 nodejs-packaging-bundler 0 2021.06-4.module_el9.3.0+88+29afeaa2
AlmaLinux:9 nodejs-packaging-bundler 0 2021.06-4.module_el9.1.0+13+d9a595ea
AlmaLinux:9 npm 0 1:10.8.1-1.20.16.0.1.module_el9.4.0+107+dbd477e4
AlmaLinux:9 npm 0 1:10.7.0-1.18.20.4.1.module_el9.4.0+112+bb28ff81
Alpine:v3.19 nodejs 0 20.15.1-r0
Alpine:v3.20 nodejs 0 20.15.1-r0
Alpine:v3.21 nodejs 0 20.15.1-r0
Alpine:v3.22 nodejs 0 20.15.1-r0
Bitnami node 0 18.20.4
Bitnami node 19.0.0 20.15.1
Bitnami node-min 0 18.20.5
Bitnami node-min 19.0.0 20.15.1
Chainguard kibana-7.17 0 7.17.22-r0
Chainguard nodejs-16-doc 0 16.20.2-r15
Chainguard nodejs-18 0 18.20.4-r0
Chainguard nodejs-18-doc 0 18.20.4-r0
Chainguard nodejs-20 0 20.15.1-r0
Chainguard nodejs-20-doc 0 20.15.1-r0
Chainguard nodejs-21-doc 0 21.7.3-r13
Chainguard nodejs-22 0 22.4.1-r0
Chainguard nodejs-22-doc 0 22.4.1-r0
Debian:12 nodejs 0 No fix
Debian:13 nodejs 0 20.15.1+dfsg-1
Debian:14 nodejs 0 20.15.1+dfsg-1
Mageia:9 nodejs 0 22.6.0-1.mga9
Mageia:9 yarnpkg 0 1.22.22-0.10.8.2.1.mga9
Red Hat:enterprise_linux:8::appstream nodejs 0 1:20.16.0-1.module+el8.10.0+22203+a88c8310
Red Hat:enterprise_linux:8::appstream nodejs 0 1:18.20.4-1.module+el8.10.0+22199+56ea0ead
Red Hat:enterprise_linux:8::appstream nodejs-debuginfo 0 1:20.16.0-1.module+el8.10.0+22203+a88c8310
Red Hat:enterprise_linux:8::appstream nodejs-debuginfo 0 1:18.20.4-1.module+el8.10.0+22199+56ea0ead
Red Hat:enterprise_linux:8::appstream nodejs-debugsource 0 1:20.16.0-1.module+el8.10.0+22203+a88c8310
Red Hat:enterprise_linux:8::appstream nodejs-debugsource 0 1:18.20.4-1.module+el8.10.0+22199+56ea0ead
Red Hat:enterprise_linux:8::appstream nodejs-devel 0 1:20.16.0-1.module+el8.10.0+22203+a88c8310
Red Hat:enterprise_linux:8::appstream nodejs-devel 0 1:18.20.4-1.module+el8.10.0+22199+56ea0ead
Red Hat:enterprise_linux:8::appstream nodejs-docs 0 1:20.16.0-1.module+el8.10.0+22203+a88c8310
Red Hat:enterprise_linux:8::appstream nodejs-docs 0 1:18.20.4-1.module+el8.10.0+22199+56ea0ead
Red Hat:enterprise_linux:8::appstream nodejs-full-i18n 0 1:20.16.0-1.module+el8.10.0+22203+a88c8310
Red Hat:enterprise_linux:8::appstream nodejs-full-i18n 0 1:18.20.4-1.module+el8.10.0+22199+56ea0ead
Red Hat:enterprise_linux:8::appstream nodejs-nodemon 0 0:3.0.1-1.module+el8.9.0+20473+c4e3d824
Red Hat:enterprise_linux:8::appstream nodejs-nodemon 0 0:3.0.1-1.module+el8.10.0+21159+f5a7145d
Red Hat:enterprise_linux:8::appstream nodejs-packaging 0 0:2021.06-4.module+el8.9.0+19519+e25b965a
Red Hat:enterprise_linux:8::appstream nodejs-packaging 0 0:2021.06-4.module+el8.9.0+19439+7b18b275
Red Hat:enterprise_linux:8::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el8.9.0+19519+e25b965a
Red Hat:enterprise_linux:8::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el8.9.0+19439+7b18b275
Red Hat:enterprise_linux:8::appstream npm 0 1:10.8.1-1.20.16.0.1.module+el8.10.0+22203+a88c8310
Red Hat:enterprise_linux:8::appstream npm 0 1:10.7.0-1.18.20.4.1.module+el8.10.0+22199+56ea0ead
Red Hat:enterprise_linux:9::appstream nodejs 0 1:20.16.0-1.module+el9.4.0+22197+9e60f127
Red Hat:enterprise_linux:9::appstream nodejs 0 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream nodejs-debuginfo 0 1:20.16.0-1.module+el9.4.0+22197+9e60f127
Red Hat:enterprise_linux:9::appstream nodejs-debuginfo 0 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream nodejs-debugsource 0 1:20.16.0-1.module+el9.4.0+22197+9e60f127
Red Hat:enterprise_linux:9::appstream nodejs-debugsource 0 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream nodejs-devel 0 1:20.16.0-1.module+el9.4.0+22197+9e60f127
Red Hat:enterprise_linux:9::appstream nodejs-devel 0 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream nodejs-docs 0 1:20.16.0-1.module+el9.4.0+22197+9e60f127
Red Hat:enterprise_linux:9::appstream nodejs-docs 0 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream nodejs-full-i18n 0 1:20.16.0-1.module+el9.4.0+22197+9e60f127
Red Hat:enterprise_linux:9::appstream nodejs-full-i18n 0 1:18.20.4-1.module+el9.4.0+22195+c221878e
Red Hat:enterprise_linux:9::appstream nodejs-nodemon 0 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781
Red Hat:enterprise_linux:9::appstream nodejs-nodemon 0 0:3.0.1-1.module+el9.3.0+19762+d716bf3b
Red Hat:enterprise_linux:9::appstream nodejs-packaging 0 0:2021.06-4.module+el9.3.0+19518+63aad52d
Red Hat:enterprise_linux:9::appstream nodejs-packaging 0 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el9.3.0+19518+63aad52d
Red Hat:enterprise_linux:9::appstream nodejs-packaging-bundler 0 0:2021.06-4.module+el9.1.0+15718+e52ec601
Red Hat:enterprise_linux:9::appstream npm 0 1:10.8.1-1.20.16.0.1.module+el9.4.0+22197+9e60f127
Red Hat:enterprise_linux:9::appstream npm 0 1:10.7.0-1.18.20.4.1.module+el9.4.0+22195+c221878e
Rocky Linux:8 nodejs 0 1:20.16.0-1.module+el8.10.0+1856+4cdb8df5
Rocky Linux:8 nodejs 0 1:18.20.4-1.module+el8.10.0+1865+67d146ca
Rocky Linux:8 nodejs-nodemon 0 0:3.0.1-1.module+el8.10.0+1666+930e28e8
Rocky Linux:8 nodejs-packaging 0 0:2021.06-4.module+el8.10.0+1667+4a788d89
Rocky Linux:9 nodejs 0 1:20.16.0-1.module+el9.4.0+25495+f51dca35
Rocky Linux:9 nodejs 0 1:18.20.4-1.module+el9.4.0+25542+b1e8296f
Rocky Linux:9 nodejs-nodemon 0 0:3.0.1-1.module+el9.4.0+25495+f51dca35
Rocky Linux:9 nodejs-nodemon 0 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01
Rocky Linux:9 nodejs-packaging 0 0:2021.06-4.module+el9.4.0+25495+f51dca35
Rocky Linux:9 nodejs-packaging 0 0:2021.06-4.module+el9.5.0+31770+0da7192d
SUSE:Linux Enterprise Module for Web and Scripting 12 nodejs18 0 18.20.4-8.24.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 nodejs18 0 18.20.4-150400.9.24.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5 nodejs20 0 20.15.1-150500.11.12.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6 nodejs20 0 20.15.1-150600.3.3.2
Ubuntu:20.04:LTS nodejs 0 No fix
Ubuntu:22.04:LTS nodejs 0 No fix
Ubuntu:24.04:LTS nodejs 0 No fix
Ubuntu:24.10 nodejs 0 No fix
Ubuntu:Pro:14.04:LTS nodejs 0 No fix
Ubuntu:Pro:16.04:LTS nodejs 0 No fix
Ubuntu:Pro:18.04:LTS nodejs 0 No fix
Wolfi nodejs-16-doc 0 16.20.2-r15
Wolfi nodejs-18 0 18.20.4-r0
Wolfi nodejs-18-doc 0 18.20.4-r0
Wolfi nodejs-20 0 20.15.1-r0
Wolfi nodejs-20-doc 0 20.15.1-r0
Wolfi nodejs-21-doc 0 21.7.3-r13
Wolfi nodejs-22 0 22.4.1-r0
Wolfi nodejs-22-doc 0 22.4.1-r0
openSUSE:Leap 15.5 nodejs18 0 18.20.4-150400.9.24.2
openSUSE:Leap 15.5 nodejs20 0 20.15.1-150500.11.12.2
openSUSE:Leap 15.6 nodejs20 0 20.15.1-150600.3.3.2
openSUSE:Tumbleweed nodejs20 0 20.15.1-1.1
openSUSE:Tumbleweed nodejs22 0 22.10.0-1.1
openSUSE:Tumbleweed nodejs24 0 24.11.1-2.1
openSUSE:Tumbleweed nodejs26 0 26.3.1-1.1

Related vulnerabilities