Symlink following in NPM - CVE-2019-16775

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU23888

Symlink following in NPM - CVE-2019-16775

Published: January 2, 2020 / Updated: February 24, 2020


Vulnerability identifier: #VU23888
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16775
CWE-ID: CWE-61
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the node_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the npm install are affected.


Affected software

NPM
Red Hat Software Collections
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for IBM z Systems
Opensuse
IBM VM Recovery Manager DR
IBM InfoSphere Information Server

How to mitigate CVE-2019-16775

Install update from vendor's website.

NPM - update to 6.13.3
IBM VM Recovery Manager DR - update to 1.5.0.1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1

External References

Related Security Bulletins