Executive brief
The cli Node.js library uses predictable temporary file names in /tmp, which can be exploited by attackers through symbolic link attacks to write arbitrary files with the privileges of the process owner. This could allow an attacker to overwrite sensitive configuration files, application code, or other critical files, potentially leading to privilege escalation or system compromise.
Technical details
The vulnerability is a symlink attack (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in the cli library's use of predictable temporary file paths. The affected versions create world-writable temporary files at hardcoded locations (/tmp/{app}.pid and /tmp/{app}.log) without checking for existing symbolic links. An attacker on the same system can pre-create symlinks at these locations pointing to sensitive files. When the cli process writes to these temporary files, it follows the symlinks and overwrites arbitrary files that the process owner has write access to. The attack requires local system access but no authentication or special privileges. The issue was fixed in version 1.0.0 and later.
Affected products
- npm cli before 1.0.0
Timeline
- 2016-06-16: disclosed: Issue reported on GitHub
- 2019-02-18: advisory: GHSA advisory published
- 2016: other: CVE-2016-10538 assigned