CVE-2024-34346: Deno Privilege Escalation Vulnerability

CVE-2024-34346 Overview

CVE-2024-34346 affects Deno, a JavaScript, TypeScript, and WebAssembly runtime designed with a permission-based security sandbox. The vulnerability allows attackers to weaken the sandbox by leveraging file read and write access to privileged system files. On Unix and Linux platforms, reading /proc/self/environ can leak environment variables equivalent to --allow-env, while writing /proc/self/mem can escalate to full --allow-all execution. The flaw stems from authorization gaps [CWE-863] in how Deno enforces its sandbox model against sensitive filesystem paths.

Critical Impact
Users granting --allow-read or --allow-write may unintentionally grant equivalent full-system privileges, bypassing the intended sandbox boundaries.

Affected Products

Deno runtime versions prior to 1.43
Deno on Linux platforms (/proc, /sys, /etc, /dev access)
Deno on Windows platforms (UNC paths beginning with \\)

Discovery Timeline

2024-05-07 - CVE-2024-34346 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34346

Vulnerability Analysis

Deno enforces a permission model where scripts must be explicitly granted access to resources such as environment variables, network sockets, and the filesystem. The vulnerability arises because filesystem permissions did not account for pseudo-files that expose kernel and process internals. An attacker with --allow-read can extract sensitive environment data from /proc/self/environ, which typically requires --allow-env. An attacker with --allow-write can modify running process memory through /proc/self/mem, achieving arbitrary code execution equivalent to --allow-all. This authorization inconsistency [CWE-863] converts limited filesystem grants into full sandbox escape primitives.

Root Cause

The root cause is missing authorization checks on privileged filesystem paths within the Deno permission subsystem. The runtime treated Linux procfs and sysfs entries, Unix device paths under /dev, and Windows UNC paths as regular filesystem targets. Documentation also failed to warn users that broad --allow-read or --allow-write grants could indirectly promote to full system access.

Attack Vector

Exploitation requires an attacker to run code within a Deno sandbox that already holds read or write permission to broad filesystem paths. The vulnerability is exploitable from an adjacent network position with low privileges and no user interaction. On Linux, an attacker reads /proc/self/environ to harvest secrets or writes shellcode into /proc/self/mem to hijack execution. On Windows, an attacker leverages UNC paths beginning with \\ to reach remote resources outside the intended filesystem scope. The scope change in the CVSS vector reflects that a compromised sandboxed script can affect the host system beyond the runtime boundary.

No verified public proof-of-concept code is available. Refer to the Deno GitHub Security Advisory GHSA-23rx-c3g5-hv9w for technical details.

Detection Methods for CVE-2024-34346

Indicators of Compromise

Deno processes accessing /proc/self/environ, /proc/self/mem, or other /proc and /sys entries during normal script execution.
Deno processes reading or writing files under /etc or /dev on Linux systems.
Deno scripts on Windows opening paths that begin with \\ targeting remote SMB shares.

Detection Strategies

Audit Deno invocations for use of --allow-read or --allow-write without explicit path scoping.
Monitor filesystem telemetry for Deno child processes touching kernel pseudo-filesystem entries.
Inventory Deno binaries across endpoints and flag versions below 1.43 for upgrade.

Monitoring Recommendations

Enable process and file access logging on hosts running Deno workloads and forward events to a centralized analytics platform.
Alert on any read of /proc/self/environ or write to /proc/self/mem by non-root, non-system processes.
Correlate Deno execution events with outbound network activity to detect post-exploitation staging.

How to Mitigate CVE-2024-34346

Immediate Actions Required

Upgrade Deno to version 1.43 or later, which requires explicit --allow-all to access privileged paths.
Audit existing Deno deployments and remove blanket --allow-read and --allow-write grants.
Restrict Deno permissions to specific directories using scoped path arguments, for example --allow-read=/app/data.

Patch Information

Deno 1.43 and later require explicit --allow-all to read or write /etc and /dev on Unix, /proc and /sys on Linux, and any path starting with \\ on Windows. See the Deno GitHub Security Advisory GHSA-23rx-c3g5-hv9w for the full fix description.

Workarounds

Run Deno inside a restricted container or namespace that hides /proc and /sys from the process.
Always specify explicit allowlisted paths with --allow-read=<path> and --allow-write=<path> instead of granting the entire filesystem.
Apply mandatory access controls such as AppArmor or SELinux profiles to block Deno access to sensitive pseudo-files.

bash

# Configuration example: run Deno with scoped permissions instead of broad access
deno run \
  --allow-read=/srv/app/data \
  --allow-write=/srv/app/output \
  --allow-net=api.example.com \
  /srv/app/main.ts