GHSA-gqf6-75v8-vr26 Arbitrary File Write in bin-links
Attackers can write arbitrary files outside node_modules via the bin field, requiring user interaction to install the package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-gqf6-75v8-vr26?
GHSA-gqf6-75v8-vr26 is a path traversal vulnerability in bin-links, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of bin-links prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite files that already exist.
Recommendation
Upgrade to version 1.1.5 or later.
Which versions are affected by GHSA-gqf6-75v8-vr26?
2 open source packages ship an affected version, including bin-links.
| Package | Affected | Fixed in |
|---|---|---|
bin-links npm | All versions | 1.1.5 |
bin-links npm | All versions | 1.1.5 |
How do I fix GHSA-gqf6-75v8-vr26?
Upgrade bin-links to 1.1.5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-gqf6-75v8-vr26 being exploited?
There is no known exploitation of GHSA-gqf6-75v8-vr26 in the wild and no public exploit code.