Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Informational severity, published 4 September 2020.
- Which products and versions are affected?
- bin-links (npm) < 1.1.6.
- Is there a fix for This vulnerability?
- A patch was published on 2020-09-04: Fixed in version 1.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked with local access, in a software library.
- Am I affected?
- Check whether you run bin-links (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a file overwrite issue in the bin-links package prior to version 1.1.6. When packages are globally installed, the bin-links module creates symlinks or copies executables to the system's global node_modules binary directory without properly checking whether a binary with the same name already exists and is owned by a different package. An attacker or rogue package can exploit this to silently overwrite legitimate global binaries with malicious ones, leading to code execution under the user's privileges. Local (per-project) installations are not affected. The fix was released in version 1.1.6.
Affected products
- npm bin-links < 1.1.6
Timeline
- 2020-09-04: disclosed
- 2020-09-04: patched: Fixed in version 1.1.6