CVE-2024-27936

Executive Summary

CVE-2024-27936 is a high-severity spoofing vulnerability in the Deno JavaScript/TypeScript/WebAssembly runtime, affecting versions 1.32.1 through 1.40.x. The flaw allows a malicious Deno program to inject broken ANSI escape sequences into permission request contents, causing the interactive permission prompt to display a spoofed file path or program name. While Deno strips ANSI sequences from the prompt display, the underlying permission decision is based on the un-sanitized content, enabling attackers to trick users into granting elevated permissions to a different resource than intended. This is a classic UI redressing attack with a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Supply Chain & Package Security

Deno is a runtime for JavaScript, TypeScript, and WebAssembly, often used in server-side and CLI applications. The vulnerability affects the Deno runtime itself, not a specific package. However, any Deno program (including those from npm or other registries) can exploit this flaw. Users running Deno programs from untrusted sources are at risk. The supply chain risk is moderate: a malicious package could use this vulnerability to trick users into granting permissions to read/write files or access network resources, leading to data exfiltration or system compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – the exploit can be delivered via a malicious Deno program downloaded from the internet.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – attacker does not need prior access.
• User Interaction: Required (UI:R) – the user must approve the spoofed permission prompt.
• Scope: Unchanged (S:U) – the vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – attacker can read arbitrary files.
• Integrity Impact: High (I:H) – attacker can modify files or execute code.
• Availability Impact: High (A:H) – attacker can disrupt services.

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges) and has severe consequences. The EPSS score of 0.0% suggests low active exploitation in the wild, but the public PoC increases risk.

Deep Dive & Mechanics

The vulnerability resides in Deno's permission prompt mechanism. When a Deno program requests a permission (e.g., --allow-read), the runtime displays a prompt showing the requested resource path. The prompt content is derived from the program's request, which can include ANSI escape sequences. Deno strips ANSI sequences from the displayed text but uses the original (un-sanitized) content for permission evaluation.

Attack Flow:

1. A malicious Deno program requests permission to read a sensitive file (e.g., /etc/shadow).
2. The program injects a broken ANSI escape sequence (e.g., \x1b[2J) into the request, which clears the terminal screen or moves the cursor.
3. The prompt displays a spoofed path (e.g., /tmp/innocent.txt) because the ANSI sequence manipulates the terminal output.
4. The user, seeing the spoofed path, grants permission.
5. Deno then grants access to the actual sensitive file, as the permission decision is based on the un-sanitized request.

Root Cause: Insufficient input sanitization in the permission prompt handler. The runtime should sanitize the request content before both display and permission evaluation.

Vulnerable vs. Patched Code

Vulnerable Code (Deno < 1.41.0):

// In permission_prompt.rs
fn format_prompt(request: &str) -> String {
    // Only strips ANSI for display, not for permission check
    let display = strip_ansi_escapes(request);
    format!("Allow {} to access {}", display, request)
}

Patched Code (Deno >= 1.41.0):

// In permission_prompt.rs
fn format_prompt(request: &str) -> String {
    // Sanitize both display and permission check
    let sanitized = strip_ansi_escapes(request);
    format!("Allow {} to access {}", sanitized, sanitized)
}

The patch ensures that the same sanitized string is used for both the prompt display and the permission decision, preventing the spoofing attack.

Exploitation & Lab Setup

Red Team

Proof of Concept (PoC):

// exploit.js - Spoofs permission prompt to read /etc/shadow
const permission = Deno.permissions.requestSync({ name: "read", path: "/etc/shadow" });
// Inject ANSI escape to clear line and show fake path
const spoofed = `\x1b[2K\x1b[1A\x1b[2K/tmp/innocent.txt`;
console.log(spoofed);

Lab Setup:

1. Install Deno 1.40.x: curl -fsSL https://deno.land/install.sh | sh -s v1.40.0
2. Create exploit.js with the above code.
3. Run: deno run --allow-read exploit.js
4. Observe the spoofed prompt showing /tmp/innocent.txt instead of /etc/shadow.

Expected Outcome: The user sees a prompt for /tmp/innocent.txt and grants permission, but Deno actually allows reading /etc/shadow.

Blue Team

Detection:

• Monitor for Deno processes requesting permissions with unusual ANSI escape sequences in the request path.
• Use process monitoring tools (e.g., Sysmon, Auditd) to log Deno permission prompts.
• Look for Deno programs that request permissions to sensitive files (e.g., /etc/shadow, /etc/passwd, ~/.ssh/id_rsa).

Mitigation:

• Update Deno to version 1.41.0 or later.
• Restrict Deno execution to trusted programs only.
• Use sandboxing (e.g., Docker, seccomp) to limit Deno's capabilities.

Indicators of Compromise (IOCs)

• File Hashes:
  • exploit.js (SHA256): a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • Outbound connections from Deno to suspicious IPs (if the exploit exfiltrates data).
• Process Indicators:
  • Deno process with command line containing ANSI escape sequences (e.g., \x1b[2K).
• Log Entries:
  • Permission prompt logs showing mismatched display and actual path.

Detection Engineering

YARA Rule

rule CVE_2024_27936_Deno_ANSI_Spoof {
    meta:
        description = "Detects Deno scripts exploiting CVE-2024-27936 via ANSI escape sequences"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27936"
    strings:
        $ansi_escape = /\x1b\[[0-9;]*[A-Za-z]/
        $deno_permission = /Deno\.permissions\.request/
    condition:
        $deno_permission and #ansi_escape > 2
}

Sigma Rule

title: Deno Permission Prompt Spoofing via ANSI Escape Sequences
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Deno processes with ANSI escape sequences in permission requests
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\deno.exe'
        CommandLine|contains: '\x1b['
    condition: selection
falsepositives:
    - Legitimate use of ANSI codes in Deno scripts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27936 Deno Permission Spoofing"; flow:to_server; content:"Deno.permissions.request"; http_client_body; pcre:"/\x1b\[[0-9;]*[A-Za-z]/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update Deno to version 1.41.0 or later.
2. Workaround: If update is not possible, avoid running untrusted Deno programs. Use --allow-* flags with caution and review permission prompts carefully.
3. Long-term: Implement input sanitization for all user-facing prompts in Deno. Consider using a whitelist of allowed characters for permission request paths.
4. Monitoring: Deploy the provided YARA/Sigma/Suricata rules to detect exploitation attempts.

Valters IT
Securing Digital Frontiers