CVE-2024-27936 (Rust, published 2024-03-21T02:52Z)
Description: value: Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. Any Deno program can spoof the content of the interactive permission prompt by inserting a broken ANSI code, which allows a malicious Deno program to display the wrong file path or program name to the user. Version 1.41.0 of the deno library contains a patch for the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/denoland/deno
Files changed:
runtime/permissions/prompter.rs
tests/integration/run_tests.rs
Commit message: feat(core): highlight unprintable chars in permission prompts (#22468)

If we strip out unprintable chars, we don't see the full filename being
requested by permission prompts. Instead, we highlight and escape them
to make them visible.

Vulnerable code:
/// Helper function to strip ansi codes and ASCII control characters.
fn strip_ansi_codes_and_ascii_control(s: &str) -> std::borrow::Cow<str> {
  console_static_text::ansi::strip_ansi_codes(s)
    .chars()
    .filter(|c| !c.is_ascii_control())
    .collect()
    let message = strip_ansi_codes_and_ascii_control(message);
    let name = strip_ansi_codes_and_ascii_control(name);
    let api_name = api_name.map(strip_ansi_codes_and_ascii_control);
fn permission_prompt_strips_ansi_codes_and_control_chars() {
      "DO YOU LIKE ICE CREAM? Y/N"
      "Do you like ice cream? y/n"
      "┌ ⚠️  Deno requests env access to \"{}\".",
    console.write_line_raw(r#"const prompt = `┌ ⚠️  ${boldANSI}Deno requests run access to "echo"${unboldANSI}\n ├ Requested by \`Deno.Command().output()`"#);
    console.expect("undefined");
    console.write_line_raw(r#"const moveANSIUp = "\u001b[1A";"#);
    console.expect("undefined");
    console.write_line_raw(r#"const clearANSI = "\u001b[2K";"#);
    console.expect("undefined");
    console.write_line_raw(r#"const moveANSIStart = "\u001b[1000D";"#);
    console.expect("undefined");

Fixed code:
/// Helper function to make control characters visible so users can see the underlying filename.
fn escape_control_characters(s: &str) -> std::borrow::Cow<str> {
  if !s.contains(|c: char| c.is_ascii_control() || c.is_control()) {
    return std::borrow::Cow::Borrowed(s);
  }
  let mut output = String::with_capacity(s.len() * 2);
  for c in s.chars() {
    match c {
      c if c.is_ascii_control() => output.push_str(
        &colors::white_bold_on_red(c.escape_debug().to_string()).to_string(),
      ),
      c if c.is_control() => output.push_str(
        &colors::white_bold_on_red(c.escape_debug().to_string()).to_string(),
      ),
      c => output.push(c),
    }
  }
  output.into()
    let message = escape_control_characters(message);
    let name = escape_control_characters(name);
    let api_name = api_name.map(escape_control_characters);
fn permission_prompt_escapes_ansi_codes_and_control_chars() {
      "\\rDO YOU LIKE ICE CREAM? Y/N"
      "\\rDo you like ice cream? y/n"
      "\u{250c} \u{26a0}\u{fe0f}  Deno requests env access to \"{}\".",
    console.write_line_raw(
      r#"new Deno.Command(`${boldANSI}cat${unboldANSI}`).spawn();"#,
    );
    console.expect("\u{250c} \u{26a0}\u{fe0f}  Deno requests run access to \"\\u{1b}[1mcat\\u{1b}[22m\".");