CVE-2024-27933

Summary

CVE-2024-27933 is a vulnerability affecting Deno, a JavaScript, TypeScript, and WebAssembly runtime. In Deno version 1.39.0, the use of raw file descriptors in `op_node_ipc_pipe()` results in premature closure of arbitrary file descriptors. This allows standard input (fd 0) to be closed and re-opened for a different resource, bypassing permission prompts. An attacker controlling code executed inside a Deno runtime can exploit this vulnerability to obtain arbitrary code execution on the host machine, regardless of permissions. The bug is known to be exploitable, and there is an existing exploit that bypasses prompts from zero permissions and abuses the Cache API's lack of filesystem permission checks. Deno version 1.39.1 addresses this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.