Node.js Vulnerabilities: Indian Cyber Agency Warns Users
CERT-In Warns Users of Node.js Vulnerabilities
The Indian Computer Emergency Response Team (CERT-In), which comes under the Ministry of Electronics & Information Technology, has warned users of multiple vulnerabilities in Node.js, which could allow an attacker to compromise the targeted system.
Affected Software Versions
The affected software includes Node.js versions prior to 18.20.4 (LTS), 20.15.1 (LTS), and 22.4.1 (Current).
Multiple Vulnerabilities Reported
Multiple vulnerabilities have been reported in Node.js, which could be exploited by an attacker to obtain sensitive information, bypass security restrictions, and execute arbitrary code on the targeted system, according to the CERT-In advisory.
Causes of Vulnerabilities
The vulnerabilities exist in Node.js due to an inadequate permission model that fails to restrict file stats "through the fs.lstat API, embedding of non-network imports in data URLs, improper handling of batch files in child_process.spawn/child_process.spawnSync, an error when the –allow-fs-write flag is used, and improper processing of UNC paths by the Permission Model".
Potential Consequences
Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information, bypass security restrictions, and execute arbitrary code on the targeted system, the agency mentioned.
Advice from CERT-In
CERT-In advised users to apply appropriate security updates as mentioned by the company.
Published Date and Time
Published On Jul 11, 2024 at 08:08 PM IST
Category and Most Read Placement
Subscription and Newsletter Section
Source Link
