Executive brief
A vulnerability in the npm package manager's dependency management library could allow a malicious package to overwrite files on a user's computer. This occurs on systems with case-insensitive file systems, such as Windows and macOS, when a package uses specially crafted names and symbolic links. An attacker could use this to gain unauthorized access to data or execute malicious code when a user installs a compromised package.
Technical details
A vulnerability exists in @npmcli/arborist, the library used by npm to manage node_modules, due to improper handling of case sensitivity and symbolic links (CWE-178, CWE-61). On case-insensitive filesystems (macOS/Windows), Arborist's internal data structures treated dependencies with names differing only by case as distinct entities. An attacker can exploit this by creating a package with a symlink dependency (e.g., 'foo') pointing to a sensitive system path, followed by another dependency with a case-variant name (e.g., 'FOO'). During installation, the second package's contents are extracted through the symlink, resulting in arbitrary file overwrite or creation. This is fixed in @npmcli/arborist 2.8.2 and npm 7.20.7.
Affected products
- npm @npmcli/arborist < 2.8.2
- npm npm < 7.20.7
Timeline
- 2021-08-31: disclosed
- 2021-08-31: advisory
- 2021-08-31: patched