Listen to this Post
The vulnerability CVE-2025-1104 exists in the Deno runtime. It is a flaw in the permission model enforcement for the `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` methods. Normally, the `–deny-write` flag should prevent all file system write operations. However, these specific methods on an open file handle (FsFile) do not check for this permission. Even when a script is run with `–deny-write=./` and a file is opened with { write: false }, these functions can be used to modify the file’s access (atime) and modification (mtime) timestamps. This constitutes a direct bypass of the security model, as the analogous functions `Deno.utime` and `Deno.utimeSync` correctly require the `–allow-write` permission, creating an inconsistency and a security hole.
Platform: Deno
Version: <=2.4.2
Vulnerability : Permission Bypass
Severity: Medium
date: 2025
Prediction: 2025-02-15
What Undercode Say:
deno run --allow-read=./ --deny-write=./ poc_file.utime.ts
using file = await Deno.open("./test.txt", { read: true, write: false});
await file.utime(new Date(), new Date());
How Exploit:
An attacker can write a script that opens a target file with read-only permissions. By calling `.utime()` or `.utimeSync()` on the returned `FsFile` object, they can change the file’s timestamps despite the active `–deny-write` permission. This bypasses the intended security policy.
Protection from this CVE
Update Deno to a version beyond 2.4.2 once a patch is released. Until then, avoid using `–deny-write` as a sole security boundary for preventing file modifications, as it is demonstrably unreliable for blocking all metadata changes.
Impact:
Permission model bypass. Integrity violation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
