CVE-2024-27933 – This vulnerability in Deno runtime version 1.39... (How to Fix)

Q: What is the severity of CVE-2024-27933?

CVE-2024-27933 has a CVSS score of 8.2 (HIGH). This vulnerability in Deno runtime version 1.39.0 allows arbitrary file descriptor manipulation, enabling attackers to bypass permission prompts and achieve arbitrary code execution on the host machine. It affects any system running Deno 1.39.0 where untrusted code can be executed. The bug allows complete permission bypass from zero initial permissions.

📋 TL;DR

This vulnerability in Deno runtime version 1.39.0 allows arbitrary file descriptor manipulation, enabling attackers to bypass permission prompts and achieve arbitrary code execution on the host machine. It affects any system running Deno 1.39.0 where untrusted code can be executed. The bug allows complete permission bypass from zero initial permissions.

💻 Affected Systems

Products:

Deno

Versions: Version 1.39.0 only

Operating Systems: All platforms where Deno runs (Linux, macOS, Windows)

Default Config Vulnerable: ⚠️ Yes

Notes: All installations of Deno 1.39.0 are vulnerable regardless of configuration. The vulnerability is in the core runtime.

📦 What is this software?

Deno by Deno

View all CVEs affecting Deno →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full host compromise with arbitrary code execution, privilege escalation, and complete system control regardless of Deno's permission model.

🟠

Likely Case

Unauthorized access to filesystem, network resources, and execution of arbitrary commands by bypassing Deno's security prompts.

🟢

If Mitigated

Limited impact if running with minimal permissions and strict code isolation, but still significant due to permission bypass capability.

🌐 Internet-Facing: HIGH - Any internet-facing Deno service running vulnerable version is at immediate risk of remote code execution.

🏢 Internal Only: HIGH - Internal systems are equally vulnerable if running untrusted code or compromised packages.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Working exploit exists that achieves arbitrary code execution by bypassing prompts from zero permissions. Attack can be conducted silently as stderr can be closed to suppress prompt outputs.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.39.1

Vendor Advisory: https://github.com/denoland/deno/releases/tag/v1.39.1

Restart Required: Yes

Instructions:

1. Stop all Deno processes. 2. Update Deno using: deno upgrade --version 1.39.1. 3. Verify update with: deno --version. 4. Restart applications using Deno.

🔧 Temporary Workarounds

Downgrade to previous version

all

Revert to Deno version 1.38.8 or earlier which is not affected

deno upgrade --version 1.38.8

Disable IPC functionality

all

Run Deno with --no-ipc flag to disable inter-process communication features

deno run --no-ipc your_script.ts

🧯 If You Can't Patch

Isolate Deno runtime in container or VM with strict network and filesystem restrictions
Implement strict allow-lists for Deno permissions using --allow-* flags with minimal scope

🔍 How to Verify

Check if Vulnerable:

Run: deno --version and check if output shows 1.39.0

Check Version:

deno --version

Verify Fix Applied:

Run: deno --version and confirm output shows 1.39.1 or higher

📡 Detection & Monitoring

Log Indicators:

Unexpected permission prompt bypasses
File descriptor manipulation errors
Cache API access without proper permissions

Network Indicators:

Unexpected outbound connections from Deno processes
IPC communication patterns matching exploit

SIEM Query:

process.name:"deno" AND process.version:"1.39.0" OR event.action:"permission_bypass"

📊 Metadata

CVE ID: CVE-2024-27933

CVSS v3 Score: 8.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-863

Published: March 21, 2024

Last Updated: January 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-27933, you might also want to check these: