CVE-2019-13173: fstream - File overwrite in fstream.DirWriter() function
Summary
CVE-2019-13173: fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Affects node-fstream across 2 version ranges.
< 1.0.12-1
< 6a77d2fa6e1462693cf8e46f930da96ec1b0bb22
Fixed in 1.0.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fstream package is a widely used module in Node.js applications for file system operations. It provides an API for reading, writing, and manipulating files and directories. The vulnerability identified as CVE-2019-13173 affects fstream versions before 1.0.12. This vulnerability allows an attacker to overwrite system files by extracting tarballs containing a hardlink to an existing file and a file that matches the hardlink. The vulnerable function is fstream.DirWriter().
Vulnerability Detail
The vulnerability arises due to a lack of proper validation when extracting tarballs. By including a hardlink to an existing file and a file that matches the hardlink, an attacker can overwrite the system's file with the contents of the extracted file. This can lead to unauthorized modification or destruction of critical system files. The fstream.DirWriter() function is specifically vulnerable to this attack.
How To Fix
Minimum fixed version
1.0.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-fstreamTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the fstream package to the fixed version.
Conclusion
The fstream package version 1.0.10 and earlier is vulnerable to a file overwrite vulnerability in the fstream.DirWriter() function. To mitigate this issue, it is crucial to update the package to version 1.0.12 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-fstream →
FAQ
This vulnerability allows an attacker to overwrite system files, potentially leading to unauthorized modification or destruction of critical files.
If your application uses fstream version 1.0.10 or earlier, it is vulnerable to this issue. Updating to version 1.0.12 or later is recommended.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to update to the fixed version to mitigate the risk.
Yes, this vulnerability can be exploited remotely if an attacker can provide a malicious tarball for extraction.
Yes, you can find more details about this vulnerability in the National Vulnerability Database (NVD) entry: CVE-2019-13173.
Related vulnerabilities
Recent vulnerabilities recorded for node-fstream.
