CVE-2021-39135

UNIX Symbolic Link (Symlink) Following (CWE-61)

Published: Aug 31, 2021 / Updated: 32mo ago

010
CVSS 7.8EPSS 0.06%High
CVE info copied to clipboard

`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2021-39135. See article

Aug 31, 2021 at 3:15 PM / github.com
EPSS

EPSS Score was set to: 0.06% (Percentile: 21.2%)

Sep 26, 2023 at 2:37 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (710906)

May 8, 2024 at 7:53 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (195166)

May 8, 2024 at 5:15 PM
Static CVE Timeline Graph

Affected Systems

Npmjs/arborist
+null more

Patches

www.oracle.com
+null more

Links to Mitre Att&cks

T1547.009: Shortcut Modification
+null more

Attack Patterns

CAPEC-27: Leveraging Race Conditions via Symbolic Links
+null more

References

SSA-389290: Third-Party Component Vulnerabilities in SINEC INS
BIND servers are vulnerable if they are running an affected version and check of host names returned by DNS (Domain Name Servers) can lead to
Oracle Critical Patch Update Advisory - October 2021
GLSA-202405-29 : Node.js: Multiple Vulnerabilities
Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
See 1 more references

News

Gentoo update for Node.js
A remote attacker can send a specially crafted HTTP/2 request, trigger a use-after-free error and execute arbitrary code on the system. The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Gentoo Linux Security Advisory 202405-29
Gentoo Linux Security Advisory 202405-29 - Multiple vulnerabilities have been discovered in Node.js. Versions greater than or equal to 16.20.2 are affected.
Rsync, NodeJS, NVIDIA Drivers, and more updates for Gentoo
Multiple vulnerabilities have been discovered in rsync, the worst of security@gentoo.org or alternatively, you may file a bug at
Security: Mehrere Probleme in Node.js (Gentoo)
https://security.gentoo.org/ Multiple vulnerabilities have been discovered in Node.js.
GLSA-202405-29 : Node.js: Multiple Vulnerabilities
Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
See 102 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI