CVE-2023-33966 - Vulnerability Details - OpenCVE

Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Deno	Deno Deno Runtime

Configuration 1 [-]

OR	cpe:2.3:a:deno:deno:1.34.0:::::::*
	cpe:2.3:a:deno:deno_runtime:0.114.0:::::rust::

No data.

References

Link	Providers
https://github.com/denoland/deno/releases/tag/v1.34.1
https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f

History

Thu, 09 Jan 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-05-31T17:15:13.791Z

Updated: 2025-01-09T20:24:06.794Z

Reserved: 2023-05-24T13:46:35.953Z

Link: CVE-2023-33966

Vulnrichment

Updated: 2024-08-02T15:54:14.202Z

NVD

Status : Modified

Published: 2023-05-31T18:15:09.527

Modified: 2024-11-21T08:06:18.630

Link: CVE-2023-33966

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-33966", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-24T13:46:35.953Z", "datePublished": "2023-05-31T17:15:13.791Z", "dateUpdated": "2025-01-09T20:24:06.794Z"}, "containers": {"cna": {"title": "Deno missing \"--allow-net\" permission check for built-in Node modules", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f"}, {"name": "https://github.com/denoland/deno/releases/tag/v1.34.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/denoland/deno/releases/tag/v1.34.1"}], "affected": [{"vendor": "denoland", "product": "deno", "versions": [{"version": "deno = 1.34.0", "status": "affected"}, {"version": "deno_runtime = 0.114.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-31T17:15:13.791Z"}, "descriptions": [{"lang": "en", "value": "Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.\n"}], "source": {"advisory": "GHSA-vc52-gwm3-8v2f", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:54:14.202Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f"}, {"name": "https://github.com/denoland/deno/releases/tag/v1.34.1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/denoland/deno/releases/tag/v1.34.1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-09T20:23:20.829088Z", "id": "CVE-2023-33966", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T20:24:06.794Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f", "name": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/denoland/deno/releases/tag/v1.34.1", "name": "https://github.com/denoland/deno/releases/tag/v1.34.1", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:54:14.202Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-33966", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-09T20:23:20.829088Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T20:24:01.116Z"}}], "cna": {"title": "Deno missing \"--allow-net\" permission check for built-in Node modules", "source": {"advisory": "GHSA-vc52-gwm3-8v2f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "denoland", "product": "deno", "versions": [{"status": "affected", "version": "deno = 1.34.0"}, {"status": "affected", "version": "deno_runtime = 0.114.0"}]}], "references": [{"url": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f", "name": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/denoland/deno/releases/tag/v1.34.1", "name": "https://github.com/denoland/deno/releases/tag/v1.34.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-31T17:15:13.791Z"}}}, "cveMetadata": {"cveId": "CVE-2023-33966", "state": "PUBLISHED", "dateUpdated": "2025-01-09T20:24:06.794Z", "dateReserved": "2023-05-24T13:46:35.953Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-05-31T17:15:13.791Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:deno:deno:1.34.0:*:*:*:*:*:*:*", "matchCriteriaId": "B7E67CC3-3EA3-429B-9C41-BB8AF9EFFF2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:deno:deno_runtime:0.114.0:*:*:*:*:rust:*:*", "matchCriteriaId": "0194D26C-BFC4-46B7-A264-E78B30D47A7B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `node:http` or `node:https` modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too. Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected. This problem has been patched in Deno v1.34.1 and deno_runtime 0.114.1 and all users are recommended to update to this version. No workaround is available for this issue.\n"}], "id": "CVE-2023-33966", "lastModified": "2024-11-21T08:06:18.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-31T18:15:09.527", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/denoland/deno/releases/tag/v1.34.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/denoland/deno/releases/tag/v1.34.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/denoland/deno/security/advisories/GHSA-vc52-gwm3-8v2f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-276"}], "source": "nvd@nist.gov", "type": "Primary"}]}