CVE-2023-33966 — Improper Privilege Management in Deno

CWE-269 — Improper Privilege ManagementCWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.2%
top 59.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
DenoDeno RuntimeDenoland Deno
Timeline
PublishedMay 31

Description

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.1…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶crates.iodeno/deno_runtime0.114.0 — 0.115.0
▶NVDdeno/deno_runtime0.114.0
▶crates.iodeno/deno1.34.0 — 1.34.1
▶NVDdeno/deno1.34.0
▶CVEListV5denoland/denodeno = 1.34.0, deno_runtime = 0.114.0+1

🔴Vulnerability Details

2
OSV
Missing "--allow-net" permission check for built-in Node modules↗2023-05-31
▶
GHSA
Missing "--allow-net" permission check for built-in Node modules↗2023-05-31
▶