PT-2022-13939 · Gruntjs+3 · Gruntjs+3

Vladikoff · Published 2022-05-10 · Updated 2023-04-05 · CVE-2022-1537

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GruntJS versions prior to 1.5.3

Description The issue concerns a TOCTOU (Time-of-Check-to-Time-of-Use) race condition in file.copy operations. This can lead to arbitrary file writes, potentially resulting in local privilege escalation if a lower-privileged user has write access to both source and destination directories. For instance, a lower-privileged user could create a symlink to the GruntJS user's .bashrc file or replace the /etc/shadow file if the GruntJS user has root privileges.

Recommendations For versions prior to 1.5.3, update to version 1.5.3 or later to resolve the issue. As a temporary workaround, consider restricting write access to source and destination directories to prevent exploitation. Additionally, monitor file system changes and access logs to detect potential malicious activity.

Exploit

Fix

LPE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

AZL-44082

CVE-2022-1537

DLA-3383-1

GHSA-RM36-94G8-835R

USN-5847-1

Affected Products

Astra Linux

Gruntjs

Linuxmint

Ubuntu

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1537.json · Exploit
• 🔥 https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d · Exploit
• https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae · Patch
• https://osv.dev/vulnerability/GHSA-rm36-94g8-835r · Vendor Advisory
• https://osv.dev/vulnerability/USN-5847-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1537 · Security Note
• https://ubuntu.com/security/notices/USN-5847-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44082 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3383-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1537 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0436 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7729 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-1537 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-1537 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-1537 · Vendor Advisory