PT-2019-5176 · Node.Js+2 · Fstream+2
Published
2019-01-15
·
Updated
2022-11-11
·
CVE-2019-13173
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
fstream versions prior to 1.0.12
Description
The issue exists due to insufficient input validation in the
fstream.DirWriter() function. This can be exploited by a remote attacker to overwrite files in the system. Specifically, extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file.Recommendations
For versions prior to 1.0.12, upgrade to version 1.0.12 or later. As a temporary workaround, consider disabling the
fstream.DirWriter() function until a patch is available. Restrict access to the fstream package to minimize the risk of exploitation. Avoid using the fstream.DirWriter() function in the affected API endpoints until the issue is resolved.Fix
Link Following
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Suse
Ubuntu
Fstream