Auto created firewall rule poses security risk

[olfek]

Today I discovered something a bit alarming.

Node.js JavaScript Runtime is an inbound firewall rule created automatically by the Node JS installer on Windows.

It looks like this:

Name: Node.js JavaScript Runtime
Group: -
Profile: Private, Public
Enabled: Yes
Action: Allow
Override: No
Program: C\program files\nodejs\node.exe
Local Address: Any
Remote Address: Any
Protocol: TCP
Local Port: Any
Remote Port: Any
Authorized Users: Any
Authorized Computers: Any
Authorized Local Principals: Any
Local User Owner: Any
Application Package: Any

[olfek]

I would say this would be OK on the Private profile, but, even then, this kind of rule should never be created without the users consent.

[olfek]

Pinging you because you are part of the security working group 🙂 @mhdawson

[bnoordhuis]

You probably installed node as part of some other package (ex. adobe bundles node with some of their products) because node's own installer doesn't add firewall exceptions. You can check that yourself, the relevant files are in tools/msvs in the repo.

[olfek]

Maybe it was some NPM CLI tool then?

[bnoordhuis]

Could be. Maybe you clicked "allow" when you ran node or npm for the first time.

[olfek]

Yeah I think I did, but I didn't know the rule would be so permissive.

The firewall rule request popup, is that not triggered by the installer?

[bnoordhuis]

No, that comes from Windows itself.

[olfek]

🤦🤦🤦 All these years, I've been clicking "Allow access" thinking the newly installed application requested necessary Firewall changes, I'm an idiot.