Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZjcGMtbWo1Yy1tOXJx

Arbitrary File Write in cli

Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to.

Proof of Concept

By creating Symbolic Links at the following locations, the target of the link can be written to.

lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';

Recommendation

Update to version 1.0.0 or later.

Permalink: https://github.com/advisories/GHSA-6cpc-mj5c-m9rq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZjcGMtbWo1Yy1tOXJx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 6 years ago
Updated: almost 2 years ago

Identifiers: GHSA-6cpc-mj5c-m9rq, CVE-2016-10538
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-10538
• https://github.com/node-js-libs/cli/issues/81
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809252
• https://github.com/advisories/GHSA-6cpc-mj5c-m9rq
• https://www.npmjs.com/advisories/95

Repository: https://github.com/node-js-libs/cli
Blast Radius: 0.0

Affected Packages