CVE-2021-39134: @npmcli/arborist UNIX Symbolic Link (Symlink) Following Vulnerability
Summary
CVE-2021-39134: @npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following. Affects @npmcli/arborist versions < 2.8.2. Fixed in 2.8.2. How to fix ↓
Also tracked for
- nodejs · Alpine:v3.11
The same CVE-2021-39134 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @npmcli/arborist library is responsible for calculating dependency trees and managing the node_modules folder hierarchy for the npm command line interface. It ensures that package dependency contracts are met and handles the extraction of package contents into the expected folder. However, a vulnerability exists in versions prior to 2.8.2 that allows for arbitrary file creation, overwrite, and code execution. This vulnerability arises from the handling of case-insensitive file systems, such as macOS and Windows, where multiple dependencies with similar names can coexist within the same level in the node_modules hierarchy. When combined with a symlink dependency, an attacker can manipulate the system to write arbitrary contents to any location on the filesystem.
Vulnerability Detail
The vulnerability allows an attacker to exploit the case-insensitive nature of file systems and symlink dependencies to write arbitrary contents to any location on the filesystem. By defining conflicting dependencies with similar names in package.json files, an attacker can trick the system into overwriting existing files or creating new ones. For example, a package 'pwn-a' can define a dependency 'foo' as 'file:/some/path', while another package 'pwn-b' defines a dependency 'FOO' as 'file:foo.tgz'. On case-insensitive file systems, if 'pwn-a' is installed first and then 'pwn-b', the contents of 'foo.tgz' will be written to '/some/path', potentially causing data loss or arbitrary code execution. This vulnerability affects npm versions up to 7.20.6 on case-insensitive file systems.
How To Fix
Minimum fixed version
2.8.2
This is the first release that contains the fix.
npm install @npmcli/arborist@2.8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update to the patched version of the @npmcli/arborist library.
Conclusion
The @npmcli/arborist library prior to version 2.8.2 is vulnerable to a symlink following vulnerability on case-insensitive file systems. This vulnerability allows an attacker to write arbitrary contents to any location on the filesystem, potentially leading to arbitrary file creation, file overwrite, and code execution. To mitigate this vulnerability, it is crucial to update to npm version 7.20.7 or above. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @npmcli/arborist →
FAQ
npm versions up to 7.20.6 on case-insensitive file systems are affected.
The vulnerability allows an attacker to write arbitrary contents to any location on the filesystem, potentially leading to arbitrary file creation, file overwrite, and code execution.
To fix this vulnerability, update to npm version 7.20.7 or above.
No, case-sensitive file systems are not affected by this vulnerability. However, there may be unpredictable behavior if two packages with names differing only in case already exist at the same level in the tree.
There is no specific workaround mentioned for this vulnerability. Updating to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for @npmcli/arborist.
