CVE-2024-34346

Executive Summary

CVE-2024-34346 is a high-severity vulnerability in the Deno runtime (versions prior to 1.43.0) that allows a sandbox escape via file system operations. The core issue is that granting --allow-read or --allow-write permissions to the entire filesystem inadvertently provides access to privileged files (e.g., /proc/self/environ, /proc/self/mem) that can be used to bypass the sandbox and gain elevated permissions. This vulnerability has a CVSS score of 8.5 and is classified as a CWE-269 (Improper Privilege Management). The vendor has addressed this in Deno 1.43.0 by requiring explicit --allow-all access for sensitive paths.

Supply Chain & Package Security

Deno is a runtime for JavaScript, TypeScript, and WebAssembly. This vulnerability affects any application or package that runs on Deno and grants broad filesystem permissions. Attackers could exploit this to read environment variables (equivalent to --allow-env) or write to process memory (equivalent to --allow-all), leading to full sandbox escape. Organizations using Deno in CI/CD pipelines, serverless functions, or containerized environments should prioritize patching.

CVSS Breakdown & Threat Level

• CVSS Score: 8.5 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a user account with Deno execution rights.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Changed (S:C) – vulnerability can affect resources beyond the sandbox.
• Confidentiality Impact: High (C:H) – full read access to sensitive files.
• Integrity Impact: High (I:H) – ability to write to process memory.
• Availability Impact: High (A:H) – potential for denial of service or system compromise.

Deep Dive & Mechanics

The Deno sandbox is designed to restrict access to system resources. However, when a user grants --allow-read or --allow-write to the entire filesystem (e.g., --allow-read=/), the sandbox does not properly filter access to sensitive pseudo-filesystems like /proc and /sys on Linux, or /dev and /etc on Unix. This allows an attacker to:

1. Read /proc/self/environ – This file contains environment variables, which may include secrets, API keys, or other sensitive data. This effectively bypasses the --allow-env permission.
2. Write to /proc/self/mem – This file allows direct memory manipulation of the current process. An attacker can overwrite memory to inject code, modify permissions, or escalate privileges to --allow-all.
3. Access other privileged paths – On Windows, paths starting with // (e.g., //./pipe/) can be used to access named pipes and other system resources.

The vulnerability arises because the sandbox checks file paths against a whitelist but does not account for the special nature of these pseudo-filesystems. The fix in Deno 1.43.0 explicitly blocks access to /etc, /dev, /proc, /sys (on Linux), and // paths (on Windows) unless --allow-all is granted.

Vulnerable vs. Patched Code

Vulnerable Code (Deno < 1.43.0):

// Example: Running with --allow-read=/ grants access to /proc/self/environ
const env = Deno.readTextFileSync("/proc/self/environ");
console.log(env); // Outputs environment variables

Patched Code (Deno >= 1.43.0):

// This will throw a PermissionDenied error unless --allow-all is used
try {
  const env = Deno.readTextFileSync("/proc/self/environ");
} catch (e) {
  console.error(e); // PermissionDenied: Requires --allow-all
}

The patch adds a check in the permission system that rejects access to the listed sensitive paths unless the --allow-all flag is explicitly provided.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install Deno < 1.43.0 (e.g., deno 1.42.0).
2. Create a malicious script exploit.js:

   // Read environment variables
   const env = Deno.readTextFileSync("/proc/self/environ");
   console.log("Environment:", env);
   
   // Write to process memory (simplified example)
   const mem = Deno.openSync("/proc/self/mem", { write: true });
   // ... memory manipulation code ...
   

3. Run with broad permissions: deno run --allow-read=/ --allow-write=/ exploit.js

Exploitation Steps:

1. The attacker gains access to a system running Deno with broad filesystem permissions.
2. They execute the script to read /proc/self/environ and extract secrets.
3. They write to /proc/self/mem to escalate privileges or execute arbitrary code.

Blue Team (Defender)

Detection:

• Monitor for Deno processes accessing /proc/self/environ or /proc/self/mem.
• Use file integrity monitoring (FIM) to detect unauthorized reads/writes to /proc and /sys.
• Audit Deno execution logs for use of --allow-read=/ or --allow-write=/ without --allow-all.

Mitigation:

• Update to Deno >= 1.43.0.
• Restrict filesystem permissions to only necessary paths (e.g., --allow-read=/tmp).
• Use containerization (e.g., Docker) to limit access to /proc and /sys.

Indicators of Compromise (IOCs)

• File Access Patterns:
  • Unauthorized reads of /proc/self/environ
  • Unauthorized writes to /proc/self/mem
  • Access to /etc/shadow or other sensitive files via Deno
• Process Behavior:
  • Deno processes running with --allow-read=/ or --allow-write=/
  • Deno processes accessing paths starting with // on Windows
• Network Indicators:
  • Exfiltration of environment variables or secrets to external IPs
• Log Entries:
  • Deno permission denied errors for /proc or /sys after patching
  • Audit logs showing access to privileged files

Detection Engineering

YARA Rule

rule CVE_2024_34346_Deno_Sandbox_Escape {
    meta:
        description = "Detects Deno scripts attempting to access privileged files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-34346"
    strings:
        $proc_env = "/proc/self/environ"
        $proc_mem = "/proc/self/mem"
        $proc_sys = "/proc/self/"
        $etc_path = "/etc/"
        $dev_path = "/dev/"
        $win_pipe = "//./pipe/"
    condition:
        any of them
}

Sigma Rule

title: Deno Sandbox Escape via Privileged File Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Deno processes accessing privileged files (CVE-2024-34346)
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/deno'
        CommandLine|contains:
            - '/proc/self/environ'
            - '/proc/self/mem'
            - '/etc/'
            - '/dev/'
    condition: selection
falsepositives:
    - Legitimate system administration scripts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34346 Deno Sandbox Escape - Privileged File Access"; flow:to_server; content:"/proc/self/environ"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to Deno 1.43.0 or later.
2. Configuration Hardening: Avoid granting broad filesystem permissions (--allow-read=/, --allow-write=/). Use specific paths instead.
3. Least Privilege: Run Deno processes with minimal permissions required for the application.
4. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to alert on suspicious file access.
5. Containerization: Use Docker or similar to restrict access to /proc and /sys.
6. Audit: Review all Deno scripts for unnecessary filesystem access.

Valters IT
Securing Digital Frontiers