Skip to content

Deno is vulnerable to race condition via interactive permission prompt spoofing

High severity GitHub Reviewed Published Jan 17, 2023 in denoland/deno • Updated Apr 3, 2023

Package

cargo deno (Rust)

Affected versions

>= 1.9.0, < 1.29.3

Patched versions

1.29.3

Description

Impact

Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action.

A malicious program could clear the terminal screen after permission prompt was shown and write a generic message like so:

// Expected prompt
⚠️  ┌ Deno requests read access to "./log.txt".
   ├ Requested by `Deno.open()` API
   ├ Run again with --allow-read to bypass this prompt.
   └ Allow? [y/n] (y = yes, allow; n = no, deny) >

// Prompt that users would see
Do you want to continue?

This situation impacts users who use Web Worker API and relied on interactive permission prompt. The reproduction is very timing sensitive and can’t be reliably reproduced on every try.

This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers).

Patches

The problem has been fixed in Deno v1.29.3; it is recommended all users update to this version.

Workarounds

Run with --no-prompt flag to disable interactive permission prompts.

References

@bartlomieju bartlomieju published to denoland/deno Jan 17, 2023
Published by the National Vulnerability Database Jan 17, 2023
Published to the GitHub Advisory Database Jan 20, 2023
Reviewed Jan 20, 2023
Last updated Apr 3, 2023

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS score

0.189%
(57th percentile)

Weaknesses

CVE ID

CVE-2023-22499

GHSA ID

GHSA-mc52-jpm2-cqh6

Source code

Credits

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.