Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-36138
CVE-2024-36138:
Node.js vulnerability analysis and mitigation
Overview
CVE-2024-36138 is a high-severity vulnerability identified as a bypass of an incomplete fix for CVE-2024-27980 (known as the BatBadBut vulnerability). The vulnerability exists in Node.js and arises from improper handling of batch files with all possible extensions on Windows via childprocess.spawn / childprocess.spawnSync. This security flaw affects all active Node.js release lines including 22.x, 20.x, and 18.x (Node.js Blog).
Technical details
The vulnerability allows malicious command line arguments to inject arbitrary commands and achieve code execution even when the shell option is disabled. The severity of this vulnerability is rated as HIGH with a CVSS v3.0 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Some sources rate it even higher, with NetApp assigning a CVSS score of 10.0 (CRITICAL) (NetApp Advisory).
Impact
The vulnerability affects all Windows users of childprocess.spawn and childprocess.spawnSync in all active Node.js release lines. Successful exploitation could lead to arbitrary code execution, potentially resulting in disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (SecurityOnline, NetApp Advisory).
Mitigation and workarounds
The Node.js project has released security updates to address this vulnerability. Users are strongly recommended to upgrade to the following patched versions: Node.js v18.20.4, Node.js v20.15.1, or Node.js v22.4.1. These updates contain patches for the vulnerability and other security issues (Node.js Blog).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management