CVE-2016-3956: npm Token Leak in CLI authentication

CVE-2016-3956 · Severity: info · CVSS 7.5 · Published 2018-07-31

npm's command-line tool for managing JavaScript packages was including authentication tokens in HTTP requests to any server, not just the configured registry. An attacker could set up a malicious server and use various methods (such as install scripts) to trick npm into making requests to it, capturing the user's authentication token. This token could then be used to publish malicious packages, delete packages, or perform any other action the compromised user is permitted to do on npm.

Technologies: npm (npm). Vendors: npm.

Quick answers

Is CVE-2016-3956 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2016-3956 being exploited in the wild.
How severe is CVE-2016-3956?
Informational severity, with a CVSS score of 7.5, published 31 July 2018.
Which products and versions are affected?
npm (npm) 0 to 2.15.0, 3.0.0 to 3.8.2.
Is there a fix for CVE-2016-3956?
A patch was published on 2016: Fixed in npm 2.15.1 and 3.8.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-3956 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2016-3956?
Check whether you run npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a credential exposure flaw (CWE-200) in npm's CLI implementation. The affected versions of npm versions 2.x (≤2.15.0) and 3.x (≤3.8.2) included the bearer token from the configured registry in every HTTP request made by the CLI, regardless of the target server. An attacker could exploit this by hosting a malicious HTTP server and using install scripts or other mechanisms to cause npm to make requests to that server, allowing the attacker to capture the bearer token. This token could then be used to compromise the user's npm account and perform unauthorized publishing or package manipulation. The vulnerability was patched in npm 2.15.1 and 3.8.3.

Affected products

  • npm npm 0 to 2.15.0, 3.0.0 to 3.8.2

Identifiers

  • CVE-2016-3956
  • GHSA-m5h6-hr3q-22h5

Timeline

  • 2016-07-02: disclosed: Published on NVD
  • 2018-07-31: advisory: GitHub Security Advisory GHSA-m5h6-hr3q-22h5 published
  • 2016: patched: Fixed in npm 2.15.1 and 3.8.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.