QID 379453

Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside of a web browser.

Multiple Vulnerabilities are reported in Node.JS 20 and 21
CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium
CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
Affected Versions:
Node.js version 20.X series prior to version 20.11.1
Node.js version 21.X series prior to version 21.6.2

QID Detection logic: (Authenticated)
QID detects the vulnerable version of NodeJS by running a npm version | grep -i node | head -1;npm config get prefix command. BR> QID detects vulnerable node.js version by executing strings command on nodejs path (obtained via ps or ls proc command)

Successful exploitation of this vulnerability could lead to a security breach or could affect integrity, availability, and confidentiality.