CVE-2019-16776: npm Arbitrary File Write Vulnerability
Summary
CVE-2019-16776: Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Affects npm across 2 version ranges.
< 6.13.4+ds-2
< 45482c25c0d169179fe56d1877e60361993cc8bd
Fixed in 6.13.4+ds-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm is a popular package manager for JavaScript that allows developers to easily install, manage, and share code modules. It is widely used in the Node.js ecosystem and plays a crucial role in building JavaScript applications. However, versions of npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write vulnerability. This vulnerability allows package publishers to modify and gain access to arbitrary files on a user's system when the package is installed. The vulnerability bypasses the --ignore-scripts install option, making it possible for attackers to exploit this issue.
Vulnerability Detail
The vulnerability (CVE-2019-16776) in npm CLI versions prior to 6.13.3 arises from the failure to prevent access to folders outside of the intended node_modules folder through the bin field in the package.json file. By constructing a specific entry in the bin field, a package publisher can manipulate and gain unauthorized access to files on a user's system during package installation. This vulnerability can be exploited through install scripts as well, further increasing the potential impact. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.7.
How To Fix
Minimum fixed version
6.13.4+ds-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade npmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update npm to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The npm Arbitrary File Write vulnerability (CVE-2019-16776) poses a significant risk to systems using npm CLI versions prior to 6.13.3. It allows package publishers to gain unauthorized access to files on a user's system during package installation. To mitigate this risk, it is essential to update npm to version 6.13.3 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm →
FAQ
npm is a package manager for JavaScript that allows developers to easily install, manage, and share code modules.
This vulnerability allows package publishers to modify and gain access to arbitrary files on a user's system when the package is installed. It can lead to unauthorized access, data manipulation, and potential compromise of the system.
To fix this vulnerability, update npm to version 6.13.3 or later by running 'npm install -g npm@6.13.3' in the terminal.
No, this vulnerability requires the installation of a malicious package by a user on their local system.
There is no known workaround for this vulnerability. It is crucial to update npm to the fixed version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for npm.
