CVE-2017-18869 Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
A local attacker can exploit a race condition in the chownr library to modify files in unintended directories via symlink attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-18869?
CVE-2017-18869 is a low-severity vulnerability in n/a, published on 15 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
Weakness: CWE-367
Which versions are affected by CVE-2017-18869?
2 open source packages ship an affected version, including chownr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
chownr npm | All versions | 1.1.0 |
chownr npm | All versions | 1.1.0 |
Products include Chownr Project Chownr.
How do I fix CVE-2017-18869?
Upgrade chownr to 1.1.0 or later.
Is CVE-2017-18869 being exploited?
There is no known exploitation of CVE-2017-18869 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1772669620, CLSA-2026-1773706634, DEBIAN-CVE-2017-18869, GHSA-c6rq-rjc2-86v2, MGASA-2021-0169, UBUNTU-CVE-2017-18869.