CVE-2024-37150
📋 TL;DR
Deno 1.44.0 incorrectly sends .npmrc authentication credentials to tarball URLs on different domains when a private registry provides cross-domain tarball links. This exposes private registry credentials to third-party domains. All users relying on .npmrc authentication with private registries that serve tarballs from different domains are affected.
💻 Affected Systems
- Deno
📦 What is this software?
Deno by Deno
⚠️ Risk & Real-World Impact
Worst Case
Private registry credentials are leaked to malicious third-party domains, allowing attackers to impersonate legitimate users, access private packages, and potentially compromise the entire registry ecosystem.
Likely Case
Accidental credential exposure to legitimate but unintended third-party domains during normal package installation operations, creating credential leakage without malicious intent.
If Mitigated
No credential leakage occurs as proper domain validation prevents sending credentials to unauthorized domains.
🎯 Exploit Status
Exploitation requires specific private registry configuration and user interaction with npm packages. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.44.1
Vendor Advisory: https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxv
Restart Required: No
Instructions:
1. Run: deno upgrade --version 1.44.1
2. Verify installation with: deno --version
3. Rotate private registry credentials if your registry serves tarballs from different domains.
🔧 Temporary Workarounds
Pin to secure version
allManually install Deno 1.44.1 or downgrade to 1.43.x
curl -fsSL https://deno.land/x/install/install.sh | sh -s v1.44.1
Disable .npmrc usage
allTemporarily avoid using .npmrc authentication with private registries
Remove or rename .npmrc file
🧯 If You Can't Patch
- Rotate all private registry credentials immediately
- Configure private registries to serve tarballs from same domain only
🔍 How to Verify
Check if Vulnerable:
Check Deno version: deno --version. If output shows 1.44.0, system is vulnerable.Check Version:
deno --versionVerify Fix Applied:
Run: deno --version. Verify output shows 1.44.1 or later.📡 Detection & Monitoring
Log Indicators:
- Unexpected authentication attempts to third-party domains during package installation
- Credential usage patterns outside expected registry domains
Network Indicators:
- HTTP requests with authentication headers to domains different from configured registry
- Unexpected outbound connections during npm package operations
SIEM Query:
source="deno" AND (url.domain!=registry.domain AND auth_header EXISTS)🔗 References
- https://github.com/denoland/deno/commit/566adb7c0a0c0845e90a6e867a2c0ef5d2ada575
- https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxv
- https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-scoped-registry%22
- https://github.com/denoland/deno/commit/566adb7c0a0c0845e90a6e867a2c0ef5d2ada575
- https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxv
- https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-scoped-registry%22
