UNIX hard link in fstream - CVE-2019-13173
Published: August 13, 2019
Vulnerability identifier: #VU20065
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-13173
CWE-ID: CWE-62
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to overwrite files on the system.
The vulnerability exists due to insufficient validation of files within archives in fstream.DirWriter() function. A remote attacker can create a tarball containing a hardlink to a file that already exists in the system and overwrite arbitrary files on the system.
Successful exploitation of the vulnerability may allow remote code execution but requires the ability to pass specially crafted tarballs to the application.
Affected software
fstream
node-fstream (Ubuntu package)
nodejs-fstream
Opensuse
openEuler
node-fstream (Ubuntu package)
nodejs-fstream
Opensuse
openEuler
How to mitigate CVE-2019-13173
Install updates from vendor's website.
fstream - update to 1.0.12
node-fstream (Ubuntu package) - addressed in versions 1.0.10-1ubuntu0.18.04.1, 1.0.10-1ubuntu0.19.04.2
nodejs-fstream - update to 1.0.12-1
node-fstream (Ubuntu package) - addressed in versions 1.0.10-1ubuntu0.18.04.1, 1.0.10-1ubuntu0.19.04.2
nodejs-fstream - update to 1.0.12-1