CVE-2021-23391: Arbitrary File Write via Archive Extraction (Zip Slip) in calipso
Summary
CVE-2021-23391: Calipso Arbitrary File Write via Archive Extraction (Zip Slip). Affects calipso versions < 0.3.54. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Calipso is an npm package that provides functionality for module installation. It is widely used for managing dependencies in Node.js applications. However, all versions of the calipso package are vulnerable to an arbitrary file write vulnerability through the module install functionality.
Vulnerability Detail
The vulnerability, known as Zip Slip, allows a malicious module to overwrite files on an arbitrary file system. This occurs during the extraction of a specially crafted archive. By manipulating the paths within the archive, an attacker can traverse directories and overwrite files outside of the intended extraction directory. This can lead to unauthorized modification or deletion of critical files, potentially resulting in a compromise of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version of calipso to mitigate the risk of arbitrary file write attacks.
Conclusion
The arbitrary file write vulnerability in calipso poses a significant risk to the security and integrity of affected systems. It is crucial to update to the patched version (0.3.55) or later to mitigate the risk of unauthorized file modifications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for calipso →
FAQ
Zip Slip is a vulnerability that occurs during the extraction of archive files. It allows an attacker to overwrite files outside of the intended extraction directory by manipulating the paths within the archive.
This vulnerability can lead to unauthorized modification or deletion of critical files on the system. An attacker could potentially compromise the integrity and security of the affected system.
Yes, the maintainers of calipso have released a fixed version (0.3.55) that addresses this vulnerability. It is recommended to update to this version or later to mitigate the risk.
Yes, all versions of the calipso package are vulnerable to this arbitrary file write vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
