CVE Vulnerabilities

CVE-2019-16775

UNIX Symbolic Link (Symlink) Following

Published: Dec 13, 2019 | Modified: Nov 21, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:N
RedHat/V2
RedHat/V3
4.8 LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM
root.io minimus.io echohq.com

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a users system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the –ignore-scripts install option.

Weakness

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Affected Software

Name Vendor Start Version End Version
Enterprise_linux Redhat 8.0 (including) 8.0 (including)
Enterprise_linux_eus Redhat 8.1 (including) 8.1 (including)
Red Hat Enterprise Linux 8 RedHat nodejs:12-8010020200116150415.c27ad7f8 *
Red Hat Enterprise Linux 8 RedHat nodejs:10-8010020200213140254.c27ad7f8 *
Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions RedHat nodejs:10-8000020200214110450.f8e95b4e *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs10-nodejs-0:10.19.0-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs12-nodejs-0:12.16.1-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs8-nodejs-0:8.17.0-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS RedHat rh-nodejs10-nodejs-0:10.19.0-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS RedHat rh-nodejs12-nodejs-0:12.16.1-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-nodejs10-nodejs-0:10.19.0-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-nodejs12-nodejs-0:12.16.1-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS RedHat rh-nodejs8-nodejs-0:8.17.0-2.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs10-nodejs-0:10.19.0-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs12-nodejs-0:12.16.1-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs8-nodejs-0:8.17.0-2.el7 *
Npm Ubuntu bionic *
Npm Ubuntu disco *
Npm Ubuntu eoan *
Npm Ubuntu focal *
Npm Ubuntu groovy *
Npm Ubuntu hirsute *
Npm Ubuntu impish *
Npm Ubuntu kinetic *
Npm Ubuntu lunar *
Npm Ubuntu mantic *
Npm Ubuntu trusty *
Npm Ubuntu trusty/esm *
Npm Ubuntu xenial *

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References