Executive brief
bin-links is a Node.js package used to create executable script symlinks in a project's bin folder. Versions before 1.1.5 fail to properly restrict where files can be created, allowing an attacker to write arbitrary files anywhere on the system during package installation. While existing files cannot be overwritten, this can still lead to system compromise through creation of malicious scripts or configuration files.
Technical details
bin-links contains a path traversal vulnerability in its handling of the bin field in package.json. The package fails to validate or sanitize the bin field paths, allowing attackers to use path traversal sequences (e.g., "../../../") to escape the intended node_modules directory and write arbitrary files outside the intended scope. The vulnerability is triggered during package installation when a malicious package specifies bin paths that point outside the node_modules folder. While the vulnerability does not permit overwriting existing files, it enables creation of new arbitrary files, which can be leveraged for system compromise. The issue is fixed in version 1.1.5 and later.
Affected products
- npm bin-links prior to 1.1.5
Timeline
- 2020-09-04: disclosed
- 2020-09-04: patched: Fix available in version 1.1.5 and later