Executive brief
npm, a widely-used package manager for JavaScript, contained a critical flaw in its directory creation logic that could cause it to unexpectedly change ownership of critical system directories like /etc and /usr when run with elevated privileges. An attacker or unprivileged user running npm with sudo could inadvertently corrupt filesystem permissions and disable key system binaries, requiring a full system reinstall to recover.
Technical details
This is a privilege escalation and arbitrary filesystem modification vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) in npm 5.7.0's "correctMkdir" implementation. When npm runs with sudo (elevated privileges) but under a non-root user context, the flawed mkdir logic recursively changes ownership of directories up the filesystem tree, including critical system paths like /etc, /usr, and /boot. The vulnerability requires local access and sudo privilege delegation, but no additional user interaction. An unprivileged user with sudo access can trigger unintended chown operations on system directories, corrupting the filesystem and disabling binaries. The issue was introduced in a pre-release (5.7.0) and fixed in version 5.7.1.
Affected products
- npm, Inc. npm 5.7.0 (pre-release); fixed in 5.7.1
Timeline
- 2018-02-22: disclosed: Issue reported on GitHub
- 2018-02-22: patched: Fix committed; version 5.7.1 released
- 2022-05-13: advisory: GHSA-ph34-pc88-72gc published