GitHub Advisoryadvisory · npm
GHSA-6cpc-mj5c-m9rq Arbitrary File Write in cli
LOW
Official page ↗
- Aliases
- CVE-2016-10538
- Ecosystem
- npm
- Packages
- cli
- Severity
- Low
- Weaknesses
- CWE-22
- Reviewed
- 2020-06-16
Affected packages
• npm cli: < 1.0.0 → fixed in 1.0.0
Description
Affected versions of `cli` use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the `cli` process has permission to write to.
Proof of Concept
By creating Symbolic Links at the following locations, the target of the link can be written to.
```
lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';
```
Recommendation
Update to version 1.0.0 or later.
Related
Alias · CVE (1)
- CVE-2016-10538 The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness