CVE-2019-16775

 

Published at: - 13-12-2019 02:15

Last modified: - 24-01-2023 05:10

Total changes: - 5

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
• https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx
• openSUSE-SU-2020:0059-Mailing List, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujan2020.html
• FEDORA-2020-595ce5e3cc-Third Party Advisory
• RHEA-2020:0330-Third Party Advisory
• RHSA-2020:0573-Third Party Advisory
• RHSA-2020:0579-Third Party Advisory
• RHSA-2020:0597-Third Party Advisory
• RHSA-2020:0602-Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html

 

Keywords

NVD

 

CVE-2019-16775

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures