Unauthorized File Access

Affecting npm package, versions <6.13.3

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

npm is a package manager for JavaScript.

Affected versions of this package are vulnerable to Unauthorized File Access. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation.

For npm, a properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. This behaviour is possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Remediation

Upgrade npm to version 6.13.3 or higher.

References

CVSS Score

2.6
low severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    Low
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    None
  • Availability
    None
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Credit
Daniel Ruf
CVE
CVE-2019-16775
CWE
CWE-552
Snyk ID
SNYK-JS-NPM-537604
Disclosed
11 Dec, 2019
Published
12 Dec, 2019