CVE-2021-39135 : What You Need to Know
Learn about CVE-2021-39135, a vulnerability in '@npmcli/arborist' library versions below 2.8.2 allowing arbitrary filesystem writes. Understand the impact, exploitation, and mitigation steps.
This CVE involves a vulnerability in '@npmcli/arborist' library versions below 2.8.2 that could allow an attacker to write package dependencies to any arbitrary location on the file system. The issue arises if the 'node_modules' folder is replaced with a symbolic link.
Understanding CVE-2021-39135
This section provides an overview of the vulnerability and its impact.
What is CVE-2021-39135?
The vulnerability allows attackers to write package dependencies to arbitrary filesystem locations by replacing the 'node_modules' folder with a symbolic link. The issue is patched in '@npmcli/arborist' version 2.8.2, included in npm v7.20.7 and above.
The Impact of CVE-2021-39135
The vulnerability has a CVSS base score of 8.2, with high severity due to its potential for high confidentiality and integrity impacts. The attack complexity is low and requires local access with user interaction.
Technical Details of CVE-2021-39135
In this section, we delve into the vulnerability's technical aspects.
Vulnerability Description
The vulnerability arises from the ability of Arborist to write package dependencies to any location on the filesystem due to a replaced 'node_modules' folder with a symbolic link.
Affected Systems and Versions
- Product: arborist
- Vendor: npm
- Versions Affected: < 2.8.2
Exploitation Mechanism
The exploit involves replacing 'node_modules' with a symlink using a preinstall script or tricking the target into running 'npm install --ignore-scripts' from a malicious git repository.
Mitigation and Prevention
Protecting systems from CVE-2021-39135 is crucial to prevent unauthorized access and data breaches.
Immediate Steps to Take
- Update '@npmcli/arborist' to version 2.8.2 or later included in npm v7.20.7 and above.
- Avoid running 'npm install' from untrusted sources or repositories.
Long-Term Security Practices
- Regularly update npm packages to the latest secure versions.
- Maintain awareness of security advisories and apply patches promptly.
Patching and Updates
Ensure all systems running npm utilize '@npmcli/arborist' version 2.8.2 or higher to mitigate the vulnerability.