PT-2019-5176 · Node.Js+2 · Fstream+2
Publicado
2019-01-15
·
Atualizado
2022-11-11
·
CVE-2019-13173
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
fstream versions prior to 1.0.12
Description
The issue exists due to insufficient input validation in the
fstream.DirWriter() function. This can be exploited by a remote attacker to overwrite files in the system. Specifically, extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file.Recommendations
For versions prior to 1.0.12, upgrade to version 1.0.12 or later. As a temporary workaround, consider disabling the
fstream.DirWriter() function until a patch is available. Restrict access to the fstream package to minimize the risk of exploitation. Avoid using the fstream.DirWriter() function in the affected API endpoints until the issue is resolved.Correção
Link Following
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Suse
Ubuntu
Fstream