Vulnerability Name:

CVE-2021-39134 (CCN-208462)

Assigned:2021-08-31
Published:2021-08-31
Updated:2022-08-12
Summary:`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in their `package.json` file such as `"foo": "file:/some/path"`. Another package, `pwn-b` could define a dependency such as `FOO: "file:foo.tgz"`. On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.2 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:4.4 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.2 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-178
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2021-39134

Source: CONFIRM
Type: Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: XF
Type: UNKNOWN
nodejs-cve202139134-symlink(208462)

Source: CCN
Type: GitHub Web site
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Source: CONFIRM
Type: Mitigation, Third Party Advisory
https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc

Source: CCN
Type: Node.js Blog, 2021-08-31
August 31 2021 Security Releases

Source: CCN
Type: IBM Security Bulletin 6497081 (App Connect Enterprise Certified Container)
IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39134

Source: CCN
Type: IBM Security Bulletin 6509088 (InfoSphere Information Server)
IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js

Source: CCN
Type: IBM Security Bulletin 6516792 (Rational Application Developer for WebSphere Software)
Multiple vulnerabilities affect IBM Rational Application Developer for WebSphere Software - September 2021

Source: CCN
Type: IBM Security Bulletin 6525674 (Rational Developer for i)
Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i

Source: CCN
Type: IBM Security Bulletin 6574479 (Cloud Private)
Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-39134)

Source: CCN
Type: IBM Security Bulletin 6575667 (Spectrum Discover)
High severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)

Source: CCN
Type: IBM Security Bulletin 6602551 (Security Verify Governance)
IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js

Source: CCN
Type: NPM Web site
@npmcli/arborist

Source: MISC
Type: Product, Third Party Advisory
https://www.npmjs.com/package/@npmcli/arborist

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2021-39134

Vulnerable Configuration:Configuration 1:
  • cpe:/a:npmjs:arborist:*:*:*:*:*:node.js:*:* (Version < 2.8.2)
  • AND
  • cpe:/a:npmjs:npm:*:*:*:*:*:*:*:* (Version < 7.20.7)

    • Configuration 2:
  • cpe:/a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*

    • Configuration 3:
  • cpe:/a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* (Version < 1.0.1.1)

    • Configuration CCN 1:
  • cpe:/a:nodejs:node.js:12:*:*:*:*:*:*:*
  • OR cpe:/a:nodejs:node.js:14.0:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:rational_application_developer:9.6:*:*:*:websphere:*:*:*
  • OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:rational_developer_for_i:9.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:rational_developer_for_i:9.6.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:rational_developer_for_i:9.6.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:rational_developer_for_i:9.6.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:rational_developer_for_i:9.6.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:rational_developer_for_i:9.6.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_private:3.2.1:cd:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_private:3.2.2:cd:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_verify_governance:10.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8168
    P
    		Security update for Salt (Moderate)
    2023-06-21
    oval:org.opensuse.security:def:8170
    P
    		Security update for salt and python-pyzmq (Moderate)
    2023-06-21
    oval:org.opensuse.security:def:8190
    P
    		Security update for terraform-provider-aws (Important) (in QA)
    2023-06-20
    oval:org.opensuse.security:def:8188
    P
    		Security update for amazon-ecs-init (Important) (in QA)
    2023-06-20
    oval:org.opensuse.security:def:20996
    P
    		Security update for nodejs12 (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:49467
    P
    		Security update for nodejs12 (Important) (in QA)
    2022-01-14
    oval:org.opensuse.security:def:111164
    P
    		Security update for nodejs12 (Important)
    2021-12-12
    oval:org.opensuse.security:def:111154
    P
    		Security update for nodejs14 (Important)
    2021-12-10
    oval:org.opensuse.security:def:102825
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:1713
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:69259
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:96135
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:109491
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:102273
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:118587
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:69279
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:111826
    P
    		Security update for nodejs14 (Important)
    2021-12-07
    oval:org.opensuse.security:def:69257
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:96133
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:109489
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:102271
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:118585
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:69277
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:111817
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:102823
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:1711
    P
    		Security update for nodejs12 (Important)
    2021-12-06
    oval:org.opensuse.security:def:49457
    P
    		Security update for nodejs14 (Important)
    2021-12-02
    oval:org.opensuse.security:def:20986
    P
    		Security update for nodejs14 (Important)
    2021-12-02
    BACK
    npmjs arborist *
    npmjs npm *
    oracle graalvm 20.3.3
    oracle graalvm 21.2.0
    siemens sinec infrastructure network services *
    nodejs node.js 12
    nodejs node.js 14.0
    ibm rational application developer 9.6
    ibm infosphere information server 11.7
    ibm rational developer for i 9.6.0
    ibm rational developer for i 9.6.0.1
    ibm rational developer for i 9.6.0.2
    ibm rational developer for i 9.6.0.3
    ibm rational developer for i 9.6.0.4
    ibm rational developer for i 9.6.0.5
    ibm cloud private 3.2.1 cd
    ibm cloud private 3.2.2 cd
    ibm security verify governance 10.0