Arbitrary File Write Vulnerability in GruntJS (CVE-2022-1537)
Summary
CVE-2022-1537: file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. Affects grunt across 2 version ranges.
< 1.3.0-1+deb11u2
< 58016ffac5ed9338b63ecc2a63710f5027362bae
Fixed in 1.3.0-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GruntJS is a popular JavaScript task runner that automates repetitive tasks in the development workflow. It allows developers to define tasks in a configuration file and execute them with a single command. GruntJS is widely used for tasks such as minification, compilation, unit testing, and linting. However, a vulnerability has been identified in its file.copy operations, which can lead to serious security issues if not addressed.
Vulnerability Detail
The vulnerability, identified as CVE-2022-1537, arises from a Time-of-Check to Time-of-Use (TOCTOU) race condition in the file.copy operations of GruntJS. This flaw allows an attacker with lower privileges to exploit the race condition and perform arbitrary file writes. If a lower-privileged user has write access to both the source and destination directories, they can create a symbolic link to sensitive files, such as the GruntJS user's .bashrc file or even replace critical system files like /etc/shadow if the GruntJS user has root privileges. This can lead to local privilege escalation and significant security risks.
How To Fix
Minimum fixed version
1.3.0-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gruntTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict write access to the directories used by GruntJS to prevent lower-privileged users from exploiting this vulnerability. This can be done by changing the permissions of the source and destination directories using the following command:
chmod 700 /path/to/source_directory
chmod 700 /path/to/destination_directory
Conclusion
CVE-2022-1537 represents a significant security risk for users of GruntJS prior to version 1.5.3. It is crucial for developers to upgrade to the latest version to mitigate the risk of arbitrary file writes and potential privilege escalation. Additionally, implementing proper directory permissions can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for grunt →
FAQ
CVE-2022-1537 is a vulnerability in GruntJS that allows arbitrary file writes due to a TOCTOU race condition in file.copy operations.
Any user of GruntJS versions prior to 1.5.3 is potentially affected, especially if they have lower-privileged users with write access to the relevant directories.
Exploitation of this vulnerability can lead to local privilege escalation, allowing an attacker to modify sensitive files or gain unauthorized access to system resources.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The CVSS score for CVE-2022-1537 is 7.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for grunt.
