CVE-2024-27932

Executive Summary

CVE-2024-27932 is a security vulnerability in the Deno JavaScript/TypeScript runtime, affecting versions 1.8.0 through 1.40.3. The flaw lies in the improper validation of import specifier hostnames against auth token hostnames. When DENO_AUTH_TOKENS is used to authenticate against a specific host (e.g., example.com), the runtime incorrectly treats a parent domain (e.g., notexample.com) as a valid match, potentially sending the auth token to an untrusted server. This is a classic hostname suffix matching error, where notexample.com is incorrectly considered a child of example.com due to a flawed string comparison. The vulnerability has a low EPSS score (0.0%) and no known public exploits, but it poses a significant risk in supply chain scenarios where untrusted code is imported. The patch in version 1.40.4 corrects the hostname comparison logic.

Supply Chain & Package Security

Deno is a runtime for JavaScript, TypeScript, and WebAssembly, often used in server-side and scripting environments. The vulnerability directly impacts supply chain security because DENO_AUTH_TOKENS is commonly used to authenticate against private registries or package repositories. If an attacker can trick a developer into importing code from a malicious domain that is a parent of the intended host, the auth token is leaked. This is particularly dangerous in CI/CD pipelines or automated build processes where tokens may have broad access. The lack of a public exploit does not diminish the risk; the flaw is a logic error that can be weaponized through social engineering or DNS manipulation.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – The attack is performed over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – The victim must import untrusted code.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality: Low (C:L) – Only the auth token is leaked.
• Integrity: None (I:N) – No data modification.
• Availability: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction (importing untrusted code) and only leaks authentication tokens. However, in a supply chain context, this can lead to lateral movement or data breaches if the token has elevated privileges.

Deep Dive & Mechanics

The vulnerability stems from the hostname validation logic in Deno's module resolution. When DENO_AUTH_TOKENS is set (e.g., DENO_AUTH_TOKENS=token@example.com), the runtime checks if the import specifier's hostname matches the token's hostname. The flawed logic uses a suffix match: it checks if the import hostname ends with the token hostname. This means notexample.com ends with example.com? No, but the bug is that the code checks if the token hostname is a suffix of the import hostname, but without proper dot-delimiter boundaries. For example, if the token is for example.com, the import hostname notexample.com would be incorrectly considered a match because example.com is a substring of notexample.com. The correct logic should ensure that the import hostname is either equal to the token hostname or is a subdomain (e.g., sub.example.com), but not a parent or unrelated domain.

Root Cause: The comparison likely uses String.endsWith() or a similar function without verifying that the preceding character is a dot (.) or that the match is at a domain boundary. This allows notexample.com to match example.com because example.com is a suffix of notexample.com.

Attack Scenario:

1. Attacker registers a domain like notexample.com.
2. Attacker hosts a malicious Deno module on notexample.com.
3. Victim has DENO_AUTH_TOKENS=token@example.com set.
4. Victim imports code from https://notexample.com/malicious.js.
5. Deno incorrectly sends the auth token to notexample.com, leaking it.

Vulnerable vs. Patched Code

Vulnerable Code (Deno < 1.40.4):

// Simplified vulnerable logic
function isHostnameAllowed(importHostname, tokenHostname) {
    // Flawed: uses endsWith without boundary check
    return importHostname.endsWith(tokenHostname);
}

Patched Code (Deno >= 1.40.4):

// Corrected logic
function isHostnameAllowed(importHostname, tokenHostname) {
    if (importHostname === tokenHostname) return true;
    // Ensure it's a subdomain: must start with a dot after the token hostname
    if (importHostname.endsWith('.' + tokenHostname)) return true;
    return false;
}

The patch ensures that the import hostname is either exactly the token hostname or a subdomain (e.g., sub.example.com), preventing parent domain matches.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A domain you control (e.g., attacker.com).
• A Deno runtime (v1.8.0 to v1.40.3) on the victim machine.
• The victim must have DENO_AUTH_TOKENS set for a domain that is a substring of your domain (e.g., example.com vs notexample.com).

Steps:

1. Set up a web server on your domain to serve a malicious Deno module.
2. Craft a module that exfiltrates the Authorization header or any token sent.
3. Trick the victim into importing your module (e.g., via a malicious package or social engineering).
4. Capture the leaked token.

Example malicious module (malicious.js):

// This module will receive the auth token in the request headers
// The token is automatically sent by Deno due to the vulnerability
export function exploit() {
    // The token is already sent; we just need to log it
    console.log("Token received (if any)");
}

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor outbound HTTP requests for unexpected Authorization headers.
• Use network traffic analysis to detect tokens being sent to unusual domains.
• Implement strict allowlists for import sources in CI/CD pipelines.

Prevention:

• Upgrade to Deno 1.40.4 or later.
• Avoid using DENO_AUTH_TOKENS with untrusted imports.
• Use a proxy or firewall to restrict outbound traffic to known registries.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from Deno processes to domains that are parent domains of the intended token hostname.
• Logs: Deno logs showing Authorization headers sent to unexpected hosts.
• File: Presence of DENO_AUTH_TOKENS environment variable in process listings.
• Behavior: Deno runtime versions between 1.8.0 and 1.40.3.

Detection Engineering

YARA Rule

rule CVE_2024_27932_Deno_Auth_Token_Leak {
    meta:
        description = "Detects Deno runtime versions vulnerable to CVE-2024-27932"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27932"
    strings:
        $deno_binary = "deno" nocase
        $version_string = /Deno\s+1\.(?:[89]|[1-3][0-9]|40\.[0-3])/
    condition:
        $deno_binary and $version_string
}

Sigma Rule

title: Deno Auth Token Leak via Hostname Validation Bypass
id: cve-2024-27932
status: experimental
description: Detects Deno runtime versions vulnerable to CVE-2024-27932
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\deno.exe'
        ProductVersion|startswith: '1.'
        ProductVersion|contains: 
            - '1.8.'
            - '1.9.'
            - '1.10.'
            - '1.11.'
            - '1.12.'
            - '1.13.'
            - '1.14.'
            - '1.15.'
            - '1.16.'
            - '1.17.'
            - '1.18.'
            - '1.19.'
            - '1.20.'
            - '1.21.'
            - '1.22.'
            - '1.23.'
            - '1.24.'
            - '1.25.'
            - '1.26.'
            - '1.27.'
            - '1.28.'
            - '1.29.'
            - '1.30.'
            - '1.31.'
            - '1.32.'
            - '1.33.'
            - '1.34.'
            - '1.35.'
            - '1.36.'
            - '1.37.'
            - '1.38.'
            - '1.39.'
            - '1.40.0'
            - '1.40.1'
            - '1.40.2'
            - '1.40.3'
    condition: selection
falsepositives:
    - Legitimate use of older Deno versions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-27932 Deno Auth Token Leak"; flow:to_server; content:"Authorization"; http_header; pcre:"/Bearer\s+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Deno to version 1.40.4 or later.
• Review all DENO_AUTH_TOKENS usage and ensure tokens are scoped to minimal permissions.

Long-term:

• Implement network segmentation to limit outbound traffic from build environments.
• Use a secrets manager to inject tokens dynamically and rotate them frequently.
• Conduct code reviews for any import specifier validation logic.

Workaround:

• If upgrade is not possible, avoid importing code from untrusted sources while using DENO_AUTH_TOKENS.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert