CVE-2020-8131: Arbitrary filesystem write via tar expansion in yarn
Summary
CVE-2020-8131: Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package. Affects node-yarnpkg across 2 version ranges.
< 1.22.4-2
< 95186d5f61ea34de7be6c59b7cfb934cc3b31988
Fixed in 1.22.4-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yarn is a package manager for JavaScript that is commonly used in Node.js projects. It allows developers to manage dependencies and install packages efficiently. However, versions of Yarn before 1.22.0 are vulnerable to an arbitrary filesystem write vulnerability, which can lead to potential arbitrary code execution. This vulnerability allows attackers to write to any path on the filesystem by forcing the user to install a malicious package.
Vulnerability Detail
The vulnerability in Yarn before version 1.22.0 arises from a lack of proper input validation during the expansion of tar files. Attackers can exploit this vulnerability by crafting a malicious package that contains specially crafted tar files. When a user installs this package using Yarn, the malicious tar files can overwrite any file on the filesystem, potentially leading to arbitrary code execution. This can have severe consequences as it allows attackers to gain unauthorized access and control over the affected system.
How To Fix
Minimum fixed version
1.22.4-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-yarnpkgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update Yarn to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The arbitrary filesystem write vulnerability in Yarn before version 1.22.0 poses a significant risk to the security of affected systems. It is crucial to update Yarn to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-yarnpkg →
FAQ
Yarn is a package manager for JavaScript that is commonly used in Node.js projects. It provides a more efficient and reliable way to manage dependencies and install packages.
This vulnerability allows attackers to write to any path on the filesystem and potentially execute arbitrary code. It can lead to unauthorized access and control over the affected system.
To fix this vulnerability, update Yarn to version 1.22.0 or later. Run the command 'npm install -g yarn@1.22.0' to update Yarn.
There is no known workaround for this vulnerability. It is essential to update Yarn to the fixed version to mitigate the risk.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) entry: https://nvd.nist.gov/vuln/detail/CVE-2020-8131
Related vulnerabilities
Recent vulnerabilities recorded for node-yarnpkg.
