CVE-2019-13173

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

CVSS v3 7.5 HIGH
CVSS v2.0 6.4 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00052.html
https://github.com/npm/fstream/commit/6a77d2fa6e1462693cf8e46f930da96ec1b0bb22	Patch Third Party Advisory
https://usn.ubuntu.com/4123-1/
https://www.npmjs.com/advisories/886	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fstream_project:fstream:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2019-07-02 20:15

Updated : 2020-08-24 17:37

NVD link : CVE-2019-13173

Mitre link : CVE-2019-13173

CVE.ORG link : CVE-2019-13173

JSON object : View

Products Affected

fstream_project

fstream

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2019-13173", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-07-02T20:15:11.823", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00010.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00052.html", "source": "cve@mitre.org"}, {"url": "https://github.com/npm/fstream/commit/6a77d2fa6e1462693cf8e46f930da96ec1b0bb22", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://usn.ubuntu.com/4123-1/", "source": "cve@mitre.org"}, {"url": "https://www.npmjs.com/advisories/886", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable."}, {"lang": "es", "value": "fstream anterior a versi\u00f3n 1.0.12, es susceptible a la sobrescritura de archivos arbitrarios. La extracci\u00f3n de archivos comprimidos que contienen un enlace f\u00edsico hacia un archivo que ya existe en el sistema y un archivo que coincida con el enlace f\u00edsico, sobrescribir\u00e1 el archivo del sistema con el contenido del archivo extra\u00eddo. La funci\u00f3n fstream.DirWriter() es vulnerable."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fstream_project:fstream:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2C9758B1-A2E4-4E63-A268-5015A593D34D", "versionEndExcluding": "1.0.12"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}