CVE-2019-5484: Symlink Arbitrary File Overwrite in bower
Summary
CVE-2019-5484: Symlink Arbitrary File Overwrite in bower. Affects bower versions < 1.8.8. Fixed in 1.8.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bower is a package manager for the web that allows developers to easily manage and install front-end dependencies. It is commonly used in JavaScript projects to handle the installation of libraries, frameworks, and other assets. However, versions of bower prior to 1.8.8 are vulnerable to an arbitrary file write vulnerability. This vulnerability arises due to a lack of verification in bower, which allows extracted symbolic links to resolve to targets outside of the extraction root directory.
Vulnerability Detail
The vulnerability in bower allows an attacker to create symbolic links that can overwrite arbitrary files on the system. By exploiting this vulnerability, an attacker can potentially overwrite critical files, leading to a variety of consequences such as unauthorized access, data loss, or even remote code execution. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.8.8
This is the first release that contains the fix.
npm install bower@1.8.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the latest version of bower to address the issue.
Conclusion
The vulnerability in bower allows for symlink arbitrary file overwrite, which can have severe consequences such as unauthorized access, data loss, or remote code execution. To mitigate this risk, it is crucial to update to version 1.8.8 or later of bower. Regularly checking for updates and promptly applying them is essential to ensure the security of your application. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bower →
FAQ
Bower is a package manager for the web that simplifies the process of managing front-end dependencies in JavaScript projects.
An arbitrary file write vulnerability allows an attacker to overwrite files on a system, potentially leading to unauthorized access, data loss, or remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
No, there is no known workaround for this vulnerability. It is crucial to update to the latest version of bower to address the issue.
