Unauthorized File Access

Affecting bin-links package, versions <1.1.5

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

bin-links is a .bin/ script linker package.

Affected versions of this package are vulnerable to Unauthorized File Access. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation.

For npm, a properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. This behaviour is possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Remediation

Upgrade bin-links to version 1.1.5 or higher.

References

CVSS Score

2.6
low severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    Low
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    None
  • Availability
    None
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Credit
Daniel Ruf
CVE
CVE-2019-16775
CWE
CWE-552
Snyk ID
SNYK-JS-BINLINKS-537609
Disclosed
11 Dec, 2019
Published
12 Dec, 2019