PT-2019-1104 · Npm+6 · Npm Cli+6
Publicado
2019-12-11
·
Atualizado
2022-08-02
·
CVE-2019-16777
CVSS v3.1
7.7
Alta
| Vetor | AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
npm CLI versions prior to 6.13.4
Description:
The issue allows for an Arbitrary File Overwrite due to the failure to prevent existing globally-installed binaries from being overwritten by other package installations. For example, if a package was installed globally and created a
serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. The vulnerability can be exploited remotely and may allow an attacker to overwrite arbitrary files in the context of the target directory. It bypasses a user using the --ignore-scripts install option.Recommendations:
Upgrade to version 6.13.4 or later. As a temporary workaround, consider restricting the use of globally-installed binaries to minimize the risk of exploitation. Avoid using the
serve binary in the affected API endpoints until the issue is resolved.Correção
Improper Privilege Management
RCE
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Npm Cli