Link following in yarn - CVE-2019-10773
Published: December 16, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30550
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-10773
CWE-ID: CWE-59
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local non-authenticated attacker to execute arbitrary code.
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Affected software
yarn
Fedora
nodejs-yarn
Fedora
nodejs-yarn
How to mitigate CVE-2019-10773
Install update from vendor's website.
yarn - update to 1.21.1
nodejs-yarn - addressed in versions 1.21.1-1.fc30, 1.21.1-1.fc31
nodejs-yarn - addressed in versions 1.21.1-1.fc30, 1.21.1-1.fc31
External References
- https://access.redhat.com/errata/RHSA-2020:0475
- https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/
- https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7
- https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/
- https://snyk.io/vuln/SNYK-JS-YARN-537806,