Vulnerabilities

Npm Patches Vulnerability Allowing Access to User Files

JavaScript package manager npm last week addressed a vulnerability that could allow a publisher to access files on a user’s system.

The issue impacts versions of npm prior to 6.13.3 and versions of yarn prior to 1.21.1, and it could be exploited through a specially crafted entry in the package.json bin field. npm v6.13.4 addresses the vulnerability.

Ionut Arghire

December 16, 2019

JavaScript package manager npm last week addressed a vulnerability that could allow a publisher to access files on a user’s system.

By exploiting the vulnerability, an attacker would be able to “modify and/or gain access to arbitrary files on a user’s system when the package is installed,” npm explains.

Additionally, in all of the affected versions of npm, as well as in all versions of yarn to date, a globally-installed package with a binary entry could overwrite an existing binary in the target install location (basically, any file in /usr/local/bin).

For both of these issues, a mitigating factor is that a malicious actor exploiting them would need to convince the victim into installing the package with the specially crafted bin entry.

“The npm, Inc. security team has been scanning the registry for examples of this attack, and have not found any published packages in the registry with this exploit. That does not guarantee that it hasn’t been used, but it does mean that it isn’t currently being used in published packages on the registry,” npm says.

To address the vulnerability, the package.json parsing libraries used in npm were updated to sanitize and validate all entries in the bin field. Thus, leading slashes, along with . and .. path entries, are now removed, and the same applies to other means of path escape.

Additionally, the bin script linking libraries in npm v6.13.4 were updated to only overwrite existing binary files currently installed on behalf of the same package.

The npm security team reviewed both fixes and assessed that they successfully patch the two vulnerabilities.

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Latest News

Click to comment

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar