CVE-2019-15608: TOCTOU vulnerability leads to cache pollution in yarn
Summary
CVE-2019-15608: The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. Affects node-yarnpkg across 2 version ranges.
< 1.19.1-1
< 0474b8c66a8ea298f5e4dedc67b2de464297ad1c
Fixed in 1.19.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yarn is a package manager for JavaScript that allows developers to manage dependencies and ensure consistent builds across different environments. It is widely used in the JavaScript ecosystem for its speed and reliability. However, versions of Yarn prior to 1.19.0 are vulnerable to a Time-of-Check Time-of-Use (TOCTOU) vulnerability, which can result in cache pollution attacks.
Vulnerability Detail
The TOCTOU vulnerability in Yarn occurs due to the package integrity validation process. When a package is written to the cache, the hash is computed. However, when reading from the cache, the hash is not recomputed. This inconsistency allows an attacker to manipulate the cache and potentially introduce malicious packages. By exploiting this vulnerability, an attacker can pollute the cache and compromise the integrity of the packages installed by unsuspecting users.
How To Fix
Minimum fixed version
1.19.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-yarnpkgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Yarn to mitigate the risk of cache pollution attacks.
Conclusion
The TOCTOU vulnerability in Yarn versions prior to 1.19.0 can lead to cache pollution attacks, compromising the integrity of packages installed by users. To mitigate this risk, it is recommended to upgrade to Yarn version 1.19.0 or later. Additionally, clearing the cache after the upgrade is advisable. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-yarnpkg →
FAQ
TOCTOU stands for Time-of-Check Time-of-Use. It is a class of vulnerabilities that occur when a resource is checked for a particular state, but its state changes before it is used. In the case of Yarn, the package integrity is checked before writing to the cache, but the hash is not recomputed when reading from the cache, leading to a potential cache pollution attack.
Cache pollution refers to the introduction of malicious or compromised packages into the package cache. In the context of Yarn, cache pollution can occur when an attacker manipulates the cache by exploiting the TOCTOU vulnerability. This can compromise the integrity of packages installed by users and potentially lead to security breaches.
You can check the version of Yarn installed by running the following command:
yarn --version
No, manually computing the hash for packages in the cache is not recommended. The fix for the TOCTOU vulnerability in Yarn ensures that the hash is correctly computed when reading from the cache. It is best to upgrade to the fixed version of Yarn rather than attempting manual computations.
There are no known public exploits of this vulnerability at the time of writing. However, it is crucial to upgrade to the fixed version of Yarn to mitigate the risk of cache pollution attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-yarnpkg.
