CVE-2024-32477
📋 TL;DR
This vulnerability allows attackers to bypass Deno's permission prompts by injecting ANSI escape sequences into standard input during a race condition. It affects all Deno users who run untrusted code or scripts that could be manipulated. The bypass enables unauthorized actions that would normally require explicit user permission.
💻 Affected Systems
- Deno
📦 What is this software?
Deno by Deno
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Deno runtime environment, allowing execution of arbitrary system commands, file system access, network connections, or environment variable access without user consent.
Likely Case
Limited privilege escalation where malicious scripts bypass specific permission prompts to perform unauthorized file reads, network requests, or command execution within the Deno sandbox.
If Mitigated
No impact if Deno is updated to patched version or if scripts are fully trusted and not exposed to malicious input.
🎯 Exploit Status
Exploit requires race condition timing and specific ANSI sequence injection, but proof-of-concept is publicly available in advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.42.2
Vendor Advisory: https://github.com/denoland/deno/security/advisories/GHSA-95cj-3hr2-7j5j
Restart Required: No
Instructions:
1. Update Deno using: deno upgrade --version 1.42.2
2. Verify update with: deno --version
3. Re-run any affected scripts with the updated runtime.
🔧 Temporary Workarounds
Disable terminal interaction
allRun Deno with --no-prompt flag to avoid permission prompts entirely (but this may break legitimate scripts requiring permissions).
deno run --no-prompt script.ts
Use explicit permission flags
allGrant all required permissions via command-line flags to avoid interactive prompts.
deno run --allow-read --allow-net script.ts
🧯 If You Can't Patch
- Run Deno scripts only from trusted sources and audit all dependencies.
- Implement strict input validation and sanitization for any user-provided content that could contain ANSI sequences.
🔍 How to Verify
Check if Vulnerable:
Check Deno version: if version is less than 1.42.2, system is vulnerable.Check Version:
deno --versionVerify Fix Applied:
Confirm version is 1.42.2 or higher and test permission prompts with known malicious sequences.📡 Detection & Monitoring
Log Indicators:
- Unexpected permission grants without user input in Deno logs
- ANSI escape sequences in standard input logs
Network Indicators:
- Unusual outbound connections from Deno processes that weren't explicitly permitted
SIEM Query:
process.name:"deno" AND (event.action:"file_read" OR event.action:"network_connection") WHERE NOT user.interactive=true