CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2021-39135 – UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
https://notcve.org/view.php?id=CVE-2021-39135
`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. • https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2 https://www.npmjs.com/package/%40npmcli/arborist https://www.oracle.com/security-alerts/cpuoct2021.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-61: UNIX Symbolic Link (Symlink) Following •
CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2021-39134 – UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
https://notcve.org/view.php?id=CVE-2021-39134
`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. • https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc https://www.npmjs.com/package/%40npmcli/arborist https://www.oracle.com/security-alerts/cpuoct2021.html • CWE-61: UNIX Symbolic Link (Symlink) Following CWE-178: Improper Handling of Case Sensitivity •
CVSS: 4.4EPSS: 0%CPEs: 4EXPL: 1CVE-2020-15095 – Sensitive information exposure through logs in npm cli
https://notcve.org/view.php?id=CVE-2020-15095
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files. Las versiones de la CLI npm anteriores a 6.14.6, son susceptibles a una vulnerabilidad de exposición de información por medio de archivos de registro. La CLI admite las URL como "://[[:]@][:][:][/]". • https://github.com/ossf-cve-benchmark/CVE-2020-15095 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07 https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq- • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.7EPSS: 0%CPEs: 6EXPL: 0CVE-2019-16777 – Arbitrary File Overwrite in npm CLI
https://notcve.org/view.php?id=CVE-2019-16777
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html https://access.redhat.com/errata/RHEA-2020:0330 https://access.redhat.com/errata/RHSA-2020:0573 https://access.redhat.com/errata/RHSA-2020:0579 https://access.redhat.com/errata/RHSA-2020:0597 https://access.redhat.com/errata/RHSA-2020:0602 https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr https://lists.fedoraproject&# • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-269: Improper Privilege Management •
CVSS: 8.1EPSS: 0%CPEs: 6EXPL: 0CVE-2019-16776 – Unauthorized File Access in npm CLI before before version 6.13.3
https://notcve.org/view.php?id=CVE-2019-16776
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html https://access.redhat.com/errata/RHEA-2020:0330 https://access.redhat.com/errata/RHSA-2020:0573 https://access.redhat.com/errata/RHSA-2020:0579 https://access.redhat.com/errata/RHSA-2020:0597 https://access.redhat.com/errata/RHSA-2020:0602 https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46 https://lists.fedoraproject&# • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •