CVE-2025-61786

Executive Summary

CVE-2025-61786 is a permission bypass vulnerability in the Deno JavaScript/TypeScript runtime, affecting versions prior to 2.5.3 and 2.2.15. The flaw allows an attacker to retrieve file metadata (stats) via Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync even when the --deny-read=./ permission flag is set. This bypasses the intended permission model, which should block read access to files. The vulnerability has a low CVSS score of 3.3 due to its local attack vector and limited impact (only metadata disclosure), but it undermines the security guarantees of Deno's sandbox.

Supply Chain & Package Security

Deno is a runtime for JavaScript, TypeScript, and WebAssembly, often used in server-side applications and tooling. While not a package manager itself, Deno's ecosystem relies on URL-based imports and third-party modules. This vulnerability could be exploited by malicious modules to leak file metadata (e.g., file size, modification times) from the host system, potentially aiding in reconnaissance for further attacks. Developers using Deno in CI/CD pipelines or production environments should update immediately to prevent information disclosure.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Local (AV:L) – requires local access to execute a script.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs to run a script with limited permissions.
• User Interaction: None (UI:N) – no user action required beyond running the script.
• Scope: Unchanged (S:U) – the vulnerability does not affect other components.
• Confidentiality: Low (C:L) – only file metadata is disclosed, not file contents.
• Integrity: None (I:N) – no data modification possible.
• Availability: None (A:N) – no denial of service.

Threat Level: Low. The vulnerability requires local execution and only leaks metadata. However, it breaks Deno's security model and could be combined with other flaws for more severe attacks.

Deep Dive & Mechanics

The vulnerability lies in the implementation of Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync. These methods are used to retrieve file statistics (e.g., size, permissions, timestamps) from an open file handle. In Deno's permission model, the --deny-read=./ flag is intended to block all read operations on files in the specified directory. However, the stat methods on FsFile objects were not properly checking this permission.

When a file is opened (e.g., with write-only flags), the FsFile object is created. Even if the script has --deny-read=./, the stat method on that object can still be called, bypassing the permission check. This contrasts with Deno.stat and Deno.statSync, which correctly enforce the allow-read permission.

The root cause is a missing permission validation in the Rust backend for FsFile::stat. The fix adds a permission check that verifies the allow-read permission before returning file stats.

Vulnerable vs. Patched Code

Vulnerable Code (Deno < 2.5.3 / < 2.2.15):

// Example of bypassing --deny-read=./ with FsFile.stat
const file = await Deno.open("./secret.txt", { write: true });
const stats = await file.stat(); // Bypasses --deny-read=./ and returns metadata
console.log(stats.size); // Outputs file size even though read is denied

Patched Code (Deno >= 2.5.3 / >= 2.2.15):

// After patch, the same code will throw a permission error
const file = await Deno.open("./secret.txt", { write: true });
try {
  const stats = await file.stat(); // Now throws Deno.errors.PermissionDenied
} catch (e) {
  console.error("Permission denied:", e.message);
}

The patch adds a permission check in the Rust layer, ensuring that FsFile::stat and FsFile::statSync respect the --deny-read flag.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Deno runtime version < 2.5.3 or < 2.2.15.
• Ability to execute a Deno script with --deny-read=./ flag.

Exploitation Steps:

1. Create a target file with sensitive metadata (e.g., secret.txt with known size).
2. Write a Deno script that opens the file with write-only flags and calls stat().
3. Execute the script with --deny-read=./ flag.
4. Observe that file metadata is leaked despite the deny flag.

Proof-of-Concept Script:

// exploit.js
const file = await Deno.open("./secret.txt", { write: true });
const stats = await file.stat();
console.log("File size:", stats.size);
console.log("Modified:", stats.mtime);

Execution:

deno run --deny-read=./ exploit.js

Expected Output:

File size: 1234
Modified: 2025-01-01T00:00:00.000Z

Blue Team

Detection:

• Monitor Deno process arguments for --deny-read flags.
• Log calls to Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync in audit logs.
• Use runtime monitoring to detect unexpected file stat operations on denied paths.

Mitigation:

• Update Deno to version 2.5.3 or 2.2.15 immediately.
• Enforce strict permission policies using --allow-read and --deny-read correctly.
• Use Deno's --allow-all only in trusted environments.

Indicators of Compromise (IOCs)

• File System Events: Unauthorized stat calls on files in denied directories.
• Deno Logs: Entries showing FsFile.stat or FsFile.statSync calls without corresponding allow-read permission.
• Process Arguments: Deno scripts executed with --deny-read but still accessing file metadata.
• Network Traffic: None (local vulnerability only).

Detection Engineering

YARA Rule

rule Deno_FsFile_Stat_Bypass {
  meta:
    description = "Detects Deno scripts exploiting CVE-2025-61786 to bypass --deny-read permission"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-61786"
  strings:
    $stat_call = "file.stat()" nocase
    $stat_sync_call = "file.statSync()" nocase
    $deny_read = "--deny-read" nocase
  condition:
    any of ($stat_call, $stat_sync_call) and $deny_read
}

Sigma Rule

title: Deno FsFile.stat Permission Bypass
id: cve-2025-61786
status: experimental
description: Detects execution of Deno scripts that bypass --deny-read permission via FsFile.stat
author: Valters IT
date: 2025-04-10
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\deno.exe'
    CommandLine|contains: '--deny-read'
    CommandLine|contains|all:
      - '.stat()'
      - '.statSync()'
  condition: selection
falsepositives:
  - Legitimate use of stat on allowed files
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-61786 Deno FsFile.stat Permission Bypass"; flow:to_server,established; content:"--deny-read"; http_uri; content:".stat()"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Deno to version 2.5.3 or 2.2.15 (or later).
2. Review all Deno scripts for use of FsFile.stat and FsFile.statSync with denied read permissions.
3. Audit logs for any unauthorized file stat operations.

Long-term Measures:

• Implement runtime permission monitoring for Deno applications.
• Use Deno's --allow-read and --deny-read flags consistently.
• Consider using Deno's --allow-all only in development environments.
• Regularly update Deno to the latest stable version.

Patch Details:

• Fixed in Deno 2.5.3 and 2.2.15.
• No official patch from OSV or GitHub advisory available.

Valters IT
Securing Digital Frontiers