// For flags

CVE-2024-22020

nodejs: Bypass network import restriction via data URL

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A security flaw in Node.js allows a bypass of network import restrictions.
By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.
Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
Exploiting this flaw can violate network import security, posing a risk to developers and servers.

Un fallo de seguridad en Node.js permite eludir las restricciones de importación de la red. Al incorporar importaciones fuera de la red en las URL de datos, un atacante puede ejecutar código arbitrario, comprometiendo la seguridad del sistema. Verificada en varias plataformas, la vulnerabilidad se mitiga al prohibir las URL de datos en las importaciones de red. La explotación de este fallo puede violar la seguridad de importación de la red, lo que representa un riesgo para los desarrolladores y servidores.

A flaw was found in the Node.js package. By embedding non-network imports in data URLs, this flaw allows an attacker to execute arbitrary code, compromising system security.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-01-04 CVE Reserved
  • 2024-07-09 CVE Published
  • 2024-07-20 EPSS Updated
  • 2024-10-25 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-284: Improper Access Control
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Node.js
Search vendor "Node.js"
 Node.js
Search vendor "Node.js" for product "Node.js"
 21.6.1
Search vendor "Node.js" for product "Node.js" and version "21.6.1"
en
Affected
Node.js
Search vendor "Node.js"
 Node.js
Search vendor "Node.js" for product "Node.js"
 20.11.0
Search vendor "Node.js" for product "Node.js" and version "20.11.0"
en
Affected
Node.js
Search vendor "Node.js"
 Node.js
Search vendor "Node.js" for product "Node.js"
 18.19.0
Search vendor "Node.js" for product "Node.js" and version "18.19.0"
en
Affected