Executive Summary

This vulnerability in Deno versions prior to 2.5.3 and 2.2.15 allows bypassing the permission model that restricts reading files. Specifically, the methods Deno.FsFile.prototype.stat and statSync do not enforce the --deny-read=./ permission, enabling a script to retrieve file statistics for files it does not have explicit read access to. This happens even when the script is executed with read permissions denied, and the file is opened with write-only flags. The issue is fixed in versions 2.5.3 and 2.2.15.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a user or script to obtain metadata about files they should not have access to, potentially exposing sensitive information such as file size, modification times, or existence of files. Although it does not allow reading the file contents, leaking file statistics can aid attackers in reconnaissance or bypassing security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Deno to version 2.5.3 or 2.2.15 or later, as these versions fix the issue where Deno.FsFile.prototype.stat and statSync bypass the permission model.

Useful 0 Not Useful 0