PT-2019-17702 · Twitter · Bower

Skyn3T · Published 2019-09-13 · Updated 2023-02-28 · CVE-2019-5484

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions bower versions prior to 1.8.8

Description The issue allows for a path traversal vulnerability, enabling file write in arbitrary locations via the install command. This occurs because bower does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory, permitting attackers to write arbitrary files when a malicious package is extracted.

Recommendations Update to version 1.8.8 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-5484

GHSA-P6MR-PXG4-68HX

Affected Products

Bower

References · 12

• 🔥 https://hackerone.com/reports/473811 · Exploit
• 🔥 https://snyk.io/blog/severe-security-vulnerability-in-bowers-zip-archive-extraction · Exploit
• https://github.com/bower/bower/commit/45c6bfa86f6e57731b153baca9e0b41a1cc699e3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-5484 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5484 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p6mr-pxg4-68hx · Vendor Advisory
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/487.json · Note
• https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E · Note
• https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E · Note
• https://npmjs.com/advisories/776 · Note