CVE-2017-18869: Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
Summary
CVE-2017-18869: Time-of-check Time-of-use (TOCTOU) Race Condition in chownr. Affects chownr versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
- node-chownr · Debian:11
The same CVE-2017-18869 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chownr package is an npm package used in Node.js 10.10. It is responsible for changing ownership of files and directories. This vulnerability affects versions prior to 1.1.0. The package is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition, which can be exploited by a local attacker to trick the package into descending into unintended directories through symlink attacks.
Vulnerability Detail
The TOCTOU race condition in the chownr package allows a local attacker to manipulate symlinks to trick the package into operating on unintended directories. By creating a symlink to a target directory and then quickly replacing it with a symlink to a different directory, the attacker can cause the package to operate on the unintended directory. This can lead to unauthorized access or modification of sensitive files or directories. The vulnerability has a CVSS score of 2.5, indicating a low severity.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
npm install chownr@1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the chownr package as soon as possible.
Conclusion
The chownr package in Node.js 10.10 is vulnerable to a TOCTOU race condition that can be exploited through symlink attacks. Users should update to version 1.1.0 or later of the chownr package to fix this vulnerability. There are no known workarounds for this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for chownr →
FAQ
This vulnerability allows a local attacker to manipulate symlinks and potentially gain unauthorized access or modify sensitive files or directories.
No, this vulnerability affects Node.js 10.10. Users of this version should update the chownr package to the fixed version.
There are no known instances of this vulnerability being exploited in the wild.
Yes, this vulnerability has a CVSS score of 2.5, indicating a low severity.
For more information, you can visit the GitHub advisory database at https://github.com/github/advisory-database/advisories/GHSA-c6rq-rjc2-86v2.
