Premature Closure of File Descriptors Leads to Arbitrary Code Execution

CVE-2024-27933

What is CVE-2024-27933?

In Deno Runtime version 1.39.0, a vulnerability exists where the use of raw file descriptors in the function op_node_ipc_pipe() can lead to the premature closure of arbitrary file descriptors. This flaw allows an attacker to close the standard input (fd 0) and subsequently re-open it for a different resource, leading to a silent permission prompt bypass. If an attacker controls the code executed within the Deno environment, they can achieve arbitrary code execution on the host system, irrespective of its permission settings. The exploit is particularly dangerous as it can operate undetected, closing stderr to suppress any prompt outputs, further enabling covert exploitation. The vulnerability has been resolved in version 1.39.1.

References