{"id":101233,"date":"2021-09-09T10:22:51","date_gmt":"2021-09-09T08:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-privodyashhaya-k-perezapisi-fajlov-v-sisteme"},"modified":"2021-09-09T10:22:51","modified_gmt":"2021-09-09T08:22:51","slug":"uyazvimost-v-npm-privodyashhaya-k-perezapisi-fajlov-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-npm-privodyashhaya-k-perezapisi-fajlov-v-sisteme","title":{"rendered":"Vulnerability in NPM leading to file overwriting in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GitHub has revealed details about seven vulnerabilities in the tar packages and @npmcli\/arborist, which provide functions for working with tar archives and calculating dependency trees in Node.js. The vulnerabilities allow specially crafted archives to overwrite files outside the root directory where the extraction takes place, depending on the current permissions. These issues enable the execution of arbitrary code in the system, for example, by adding commands to ~\/.bashrc or ~\/.profile when performed by an unprivileged user, or by replacing system files when executed with root privileges. <\/p>\n
The danger of vulnerabilities is exacerbated by the fact that problematic code is used in the npm package manager during operations with npm packages, allowing an attack on users by placing a specially crafted npm package in the repository, where the attacker's code will be executed in the system during processing. The attack is possible even when installing packages in «—ignore-scripts» mode, which disables the execution of built-in scripts. In total, npm is affected by four vulnerabilities (CVE-2021-32804, CVE-2021-37713, CVE-2021-39134, and CVE-2021-39135) out of seven. The first two issues concern the tar package, while the other two are related to the @npmcli\/arborist package. <\/p>\n
The most dangerous vulnerability CVE-2021-32804 arises from the incorrect handling of repeated «\\\/» characters when cleaning the absolute paths specified in the tar archive \u2014 only the first character is removed, while the others are left intact. For example, the path «\\\/home\\\/user\\\/.bashrc» will be transformed into «home\\\/user\\\/.bashrc», while the path «\\\/\\\/home\\\/user\\\/.bashrc» will be changed to «\\\/home\\\/user\\\/.bashrc». The second vulnerability CVE-2021-37713 manifests only on the Windows platform and is related to the improper cleaning of relative paths that include an unseparated drive symbol («C:some\\path») and a sequence to return to the previous directory («C:..\\\/foo»). <\/p>\n
The vulnerabilities CVE-2021-39134 and CVE-2021-39135 are specific to the @npmcli\/arborist module. The first issue appears only on case-insensitive file systems (macOS and Windows) and allows files to be written to arbitrary locations in the file system by specifying two modules in the dependencies: ‘»foo»: «file:\\\/some\\\/path»‘ and ‘FOO: «file:foo.tgz»‘, the processing of which will result in the deletion of the contents of the \/some\/path directory and writing of the contents of foo.tgz into it. The second issue allows files to be overwritten through manipulation with symbolic links. <\/p>\n
The vulnerabilities have been fixed in Node.js releases 12.22.6 and 14.17.6, npm CLI 6.14.15 and 7.21.0, as well as in separate releases of the tar package 4.4.19, 5.0.11, and 6.1.10. Upon receiving information about the problem as part of the «bug bounty» initiative, GitHub paid researchers $14,500 and scanned the repository\u2019s content, which did not reveal any attempts to exploit the vulnerabilities. To protect against these issues, GitHub has also introduced a ban on publishing npm packages that include symbolic links, hard links, and absolute paths. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"