PT-2016-5777 · Npm+3 · Npm+3

James Taylor + 3 · Publicado 2016-04-13 · Atualizado 2021-06-15 · CVE-2016-3956

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions npm versions prior to 2.15.1 npm versions 3.x prior to 3.8.3 Node.js versions 0.10 prior to 0.10.44 Node.js versions 0.12 prior to 0.12.13 Node.js versions 4 prior to 4.4.2 Node.js versions 5 prior to 5.10.0

Description The issue allows remote HTTP servers to obtain sensitive information by reading Authorization headers, as the CLI in npm includes bearer tokens with arbitrary requests. An attacker could create an HTTP server to collect tokens and compromise the user's token by causing the npm CLI to make a request to that server. This compromised token could be used to perform actions that the user could do, including publishing new packages.

Recommendations Update npm with npm install npm@latest -g Revoke your Tokens Enable Two-Factor Authentication

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2016-1328

CVE-2016-3956

GHSA-M5H6-HR3Q-22H5

USN-4785-1

Produtos afetados

Alt Linux

Node.Js

Ubuntu

Npm

Referências · 18

• https://github.com/npm/npm/issues/8380 · Nota
• https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29 · Correção
• https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401 · Correção
• https://cve.org/CVERecord?id=CVE-2016-3956 · Nota de Segurança
• https://osv.dev/vulnerability/USN-4785-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3956 · Nota de Segurança
• https://npmjs.com/advisories/98 · Nota
• https://osv.dev/vulnerability/GHSA-m5h6-hr3q-22h5 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-3956 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21980827 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3956 · Aviso do Fabricante
• http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-3956 · Aviso do Fabricante
• https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-3956 · Aviso do Fabricante