CVE-2013-4116: npm predictable temporary file symlink privilege escalation

CVE-2013-4116 · Severity: info · CVSS 3.3 · Published 2020-09-01

npm, the Node.js package manager, uses predictable temporary file names when unpacking packages. An attacker with local file system access can create symbolic links at these predictable locations to cause npm to write files to arbitrary locations that the npm user has permission to access, potentially leading to privilege escalation or unauthorized file modification on a system.

Technologies: npm (npm). Vendors: npm.

Quick answers

Is CVE-2013-4116 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2013-4116 being exploited in the wild.
How severe is CVE-2013-4116?
Informational severity, with a CVSS score of 3.3, published 1 September 2020.
Which products and versions are affected?
npm (npm) before 1.3.3.
Is there a fix for CVE-2013-4116?
A patch was published on 2013: Fixed in version 1.3.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2013-4116 attacked?
It is attacked with local access.
Am I affected by CVE-2013-4116?
Check whether you run npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a symlink attack (CWE-59) in npm's archive unpacking process. npm creates temporary files with predictable names (e.g., /tmp/npm-$PID) in world-writable directories during package installation and unpacking. An attacker can race the process or predict the PID to create a symbolic link at the temporary file location, causing subsequent file write operations to follow the symlink and write to arbitrary files accessible to the npm user. This allows privilege escalation if npm is run as a privileged user. No authentication is required; only local file system access is needed. The vulnerability was fixed in npm version 1.3.3 and later.

Affected products

  • npm npm before 1.3.3

Identifiers

  • CVE-2013-4116
  • GHSA-v3jv-wrf4-5845

Timeline

  • 2013-07-08: disclosed
  • 2013: patched: Fixed in version 1.3.3
  • 2020-09-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.