CVE-2021-39135: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
Impact
Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution
@npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.
This is accomplished by extracting package contents into a project's nodemodules folder.
If the nodemodules folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system.
Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a nodemodules symbolic link would have to be employed.
1. A preinstall script could replace nodemodules with a symlink. (This is prevented by using --ignore-scripts.) 2. An attacker could supply the target with a git repository, instructing them to run npm install --ignore-scripts in the root. This may be successful, because npm install --ignore-scripts is typically not capable of making changes outside of the project directory, so it may be deemed safe.
Patches
2.8.2 (included in npm v7.20.7 and above)
Workarounds
Do not run npm install on untrusted codebases, without first ensuring that the nodemodules directory in the project is not a symbolic link.
Fix
Prior to extracting any package contents, the nodemodules folder into which it is extracted is verified to be a real directory. If it is not, then it is removed.
Caveat: if you are currently relying on creating a symbolic link to the nodemodules folder in order to share dependencies between projects, then that will no longer be possible. Please use the npm link command, explicit file:... dependencies, and/or workspaces to share dependencies in a development environment.
Other sources
@npmcli/arborist, the library that calculates dependency trees and manages the nodemodules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's nodemodules folder. If the nodemodules folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a nodemodules symbolic link would have to be employed. 1. A preinstall script could replace nodemodules with a symlink. (This is prevented by using --ignore-scripts.) 2. An attacker could supply the target with a git repository, instructing them to run npm install --ignore-scripts in the root. This may be successful, because npm install --ignore-scripts is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.
— MITRE
npm 6 update - node-tar, aborist, npm client modules. These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist. You can read more about it in: https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc, https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p, https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh, https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc), https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@npmcli/arboristto a version that resolves this vulnerability.Fixed in 2.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.6Fixed in 14.17.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.17.6 - Upgrade
Upgrade
@npmcli/arboristto a version that resolves this vulnerability.Fixed in 2.8.2 - Compensating control
Use npm install --ignore-scripts when installing untrusted codebases.
- Compensating control
Before running npm install on an untrusted codebase, ensure the root project's node_modules directory is not a symbolic link.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-39135?
CVE-2021-39135 is a vulnerability in `@npmcli/arborist` library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface.
What is the severity of CVE-2021-39135?
The severity of CVE-2021-39135 is high with a CVSS score of 7.8.
Which software are affected by CVE-2021-39135?
The software affected by CVE-2021-39135 are `@npmcli/arborist` versions up to 2.8.2, Oracle GraalVM 20.3.3 and 21.2.0, and Siemens Sinec Infrastructure Network Services up to version 1.0.1.1.
How can I fix CVE-2021-39135?
To fix CVE-2021-39135, update `@npmcli/arborist` to a version higher than 2.8.2, upgrade Oracle GraalVM to a version beyond 20.3.3 or 21.2.0, and update Siemens Sinec Infrastructure Network Services to a version higher than 1.0.1.1.
Where can I find more information about CVE-2021-39135?
You can find more information about CVE-2021-39135 in the following references: [Siemens advisory](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf), [GitHub Security Advisory](https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2), [npm package reference](https://www.npmjs.com/package/@npmcli/arborist).