CVE-2017-16024 Tmp files readable by other users in sync-exec
Local attackers can read confidential data from temporary files created by the sync-exec module due to insecure permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-16024?
CVE-2017-16024 is a medium-severity vulnerability in Nodejs Node.js, published on 4 Jun 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.
Which versions are affected by CVE-2017-16024?
2 open source packages ship an affected version, including sync-exec. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
sync-exec npm | All versions to 0.6.2 | None |
sync-exec npm | All versions to 0.6.2 | None |
Products include Nodejs Node.js, Sync-Exec Project Sync-Exec.
How do I fix CVE-2017-16024?
No fix has been published for CVE-2017-16024 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-16024 being exploited?
There is no known exploitation of CVE-2017-16024 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as GHSA-38h8-x697-gh8q.