Executive brief
npm's command-line tool for managing JavaScript packages was including authentication tokens in HTTP requests to any server, not just the configured registry. An attacker could set up a malicious server and use various methods (such as install scripts) to trick npm into making requests to it, capturing the user's authentication token. This token could then be used to publish malicious packages, delete packages, or perform any other action the compromised user is permitted to do on npm.
Technical details
The vulnerability is a credential exposure flaw (CWE-200) in npm's CLI implementation. The affected versions of npm versions 2.x (≤2.15.0) and 3.x (≤3.8.2) included the bearer token from the configured registry in every HTTP request made by the CLI, regardless of the target server. An attacker could exploit this by hosting a malicious HTTP server and using install scripts or other mechanisms to cause npm to make requests to that server, allowing the attacker to capture the bearer token. This token could then be used to compromise the user's npm account and perform unauthorized publishing or package manipulation. The vulnerability was patched in npm 2.15.1 and 3.8.3.
Affected products
- npm npm 0 to 2.15.0, 3.0.0 to 3.8.2
Timeline
- 2016-07-02: disclosed: Published on NVD
- 2018-07-31: advisory: GitHub Security Advisory GHSA-m5h6-hr3q-22h5 published
- 2016: patched: Fixed in npm 2.15.1 and 3.8.3