CVE-2024-36137

What it actually does

The experimental permission model in Node.js does not enforce restrictions on file descriptor operations; when --allow-fs-write is used, calls such as fs.fchown and fs.fchmod on a read-only file descriptor can still alter file ownership and permissions.

Why it matters to the business

Limited write access intended by the permission model can be bypassed, allowing unauthorized changes to file metadata that may enable further system modifications or access escalation.

How an attack unfolds

An attacker obtains a read-only file descriptor through allowed operations, then invokes fs.fchown or fs.fchmod on that descriptor to modify ownership or permissions of the underlying file, bypassing the permission model's intended restrictions.

How to fix it

Upgrade Node.js to a version that enforces permission checks on file descriptor operations; apply the equivalent fixes listed for affected packages where applicable.

How to confirm the fix worked

Confirm the installed Node.js version includes permission model enforcement on file descriptors; test that fs.fchown and fs.fchmod on read-only descriptors are denied under --allow-fs-write.

Typical attack path

1. Obtain a file descriptor via permitted read-only operations under the --allow-fs-write flag
2. Call fs.fchown or fs.fchmod using the read-only descriptor
3. Modify file ownership or permissions without explicit write authorization
4. Leverage altered permissions for subsequent unauthorized actions

How to detect it

Review application and system logs for unexpected fs.fchown or fs.fchmod calls on descriptors opened with limited permissions; inspect file metadata changes that occur without corresponding write operations in audit trails.

What your security team should do

• Disable the experimental permission model until fixed versions are deployed if feasible
• Audit all uses of --allow-fs-write and restrict to minimal necessary paths
• Monitor for unexpected changes to file ownership or permissions in protected directories
• Plan upgrade to a patched Node.js release at the earliest maintenance window