CVE-2019-16775
Unauthorized File Access in npm CLI before before version 6.13.3
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Las versiones del npm CLI en versiones anteriores a la 6.13.3 son vulnerables a una escritura de archivo arbitraria. Es posible que los paquetes creen enlaces simbólicos a archivos fuera de la carpeta thenode_modules a través del campo bin al momento de la instalación. Una entrada construida correctamente en el campo bin de package.json permitiría a un editor de paquetes crear un enlace simbólico que apunte a archivos arbitrarios en el sistema de un usuario cuando se instala el paquete. Este comportamiento todavía es posible mediante los scripts de instalación. Esta vulnerabilidad evita que un usuario utilice la opción de instalación --ignore-scripts.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-09-24 CVE Reserved
- 2019-12-13 CVE Published
- 2024-04-07 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-59: Improper Link Resolution Before File Access ('Link Following')
- CWE-61: UNIX Symbolic Link (Symlink) Following
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli | Third Party Advisory | |
| https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx | Third Party Advisory | |
| https://www.oracle.com/security-alerts/cpujan2020.html | Third Party Advisory |
|
| https://www.oracle.com/security-alerts/cpuoct2021.html | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Eus Search vendor "Redhat" for product "Enterprise Linux Eus" | 8.1 Search vendor "Redhat" for product "Enterprise Linux Eus" and version "8.1" | - |
Affected
| ||||||
| Npmjs Search vendor "Npmjs" | Npm Search vendor "Npmjs" for product "Npm" | < 6.13.3 Search vendor "Npmjs" for product "Npm" and version " < 6.13.3" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.1 Search vendor "Opensuse" for product "Leap" and version "15.1" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 19.3.0.2 Search vendor "Oracle" for product "Graalvm" and version "19.3.0.2" | enterprise |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 20.3.3 Search vendor "Oracle" for product "Graalvm" and version "20.3.3" | enterprise |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 21.2.2 Search vendor "Oracle" for product "Graalvm" and version "21.2.2" | enterprise |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 31 Search vendor "Fedoraproject" for product "Fedora" and version "31" | - |
Affected
| ||||||