CVE-2017-16024: sync-exec - Tmp files readable by other users in sync-exec
Summary
CVE-2017-16024: Tmp files readable by other users in sync-exec. Affects sync-exec versions < 0.6.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sync-exec is an npm package that provides a synchronous version of the child_process.exec() function in Node.js. It allows users to execute shell commands synchronously and retrieve the output. However, affected versions of sync-exec use temporary files located in /tmp/ to buffer command results before returning values. These temporary files are created with world-readable permissions, which can allow low privilege users on the system to read the results of commands run via sync-exec under a higher privilege user.
Vulnerability Detail
The vulnerability arises from the use of world-readable temporary files in sync-exec. As a result, low privilege users can access and read the command results of higher privilege users. This can lead to the exposure of sensitive information and potential privilege escalation attacks. The vulnerability has a moderate severity rating (CWE-377).
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To mitigate the vulnerability, follow these steps:
- Update Node.js to v0.12.0 or later.
- Replace all instances of sync-exec with child_process.execSync().
- Ensure that the temporary files used by child_process.execSync() have appropriate permissions to prevent unauthorized access.
Conclusion
The vulnerability in sync-exec allows low privilege users to read the command results of higher privilege users due to the use of world-readable temporary files. To mitigate this vulnerability, it is recommended to update to Node.js v0.12.0 or later and migrate all uses of sync-exec to child_process.execSync(). For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sync-exec →
FAQ
sync-exec is an npm package that provides a synchronous version of the child_process.exec() function in Node.js. It allows users to execute shell commands synchronously and retrieve the output.
The vulnerability arises from the use of world-readable temporary files in sync-exec. These files are created in /tmp/ and can be accessed by low privilege users, allowing them to read the command results of higher privilege users.
The vulnerability can lead to the exposure of sensitive information and potential privilege escalation attacks. Low privilege users can access and read the command results of higher privilege users, compromising the security of the system.
There is currently no direct patch for sync-exec. However, updating to Node.js v0.12.0 or later and migrating to child_process.execSync() can mitigate the vulnerability.
The vulnerability has a moderate severity rating (CWE-377). It is important to update Node.js and migrate to child_process.execSync() to prevent potential security breaches.
