Skip to content

Arbitrary File Write in cli

Low severity GitHub Reviewed Published Feb 18, 2019 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm cli (npm)

Affected versions

< 1.0.0

Patched versions

1.0.0

Description

Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to.

Proof of Concept

By creating Symbolic Links at the following locations, the target of the link can be written to.

lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';

Recommendation

Update to version 1.0.0 or later.

References

Published to the GitHub Advisory Database Feb 18, 2019
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

Low

EPSS score

0.098%
(42nd percentile)

Weaknesses

CVE ID

CVE-2016-10538

GHSA ID

GHSA-6cpc-mj5c-m9rq

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.