Executive brief
chownr is a Node.js utility that recursively changes file ownership. A timing vulnerability allows a local attacker to exploit a race condition by creating symlinks between the time ownership checks occur and when changes are applied, potentially causing the tool to modify files in unintended directories. This could allow privilege escalation or unauthorized access to files on systems where chownr is used.
Technical details
The chownr package before version 1.1.0 contains a Time-of-Check-Time-of-Use (TOCTOU) race condition (CWE-367) in its directory traversal logic. An attacker with local filesystem access can exploit this by creating symlinks after the package validates a directory path but before it performs the actual ownership change, redirecting operations to arbitrary directories. This vulnerability requires local access and the ability to manipulate the filesystem during execution, but no special privileges are needed to trigger the race condition. The issue was resolved in version 1.1.0 through improved handling of symlinks.
Affected products
- npm chownr before 1.1.0
Timeline
- 2017-07-02: disclosed: TOCTOU issue reported on GitHub
- 2022-02-10: advisory: GHSA-c6rq-rjc2-86v2 published
- 1.1.0: patched: Fix released in version 1.1.0