REDHAT-BUG-2487946: Path Traversal
tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tmp/npm packageto a version that resolves this vulnerability.Fixed in 0.2.6
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using tmp before 0.2.6 are affected when untrusted data is passed into the prefix, postfix, or dir options of tmp file or directory creation functions. Applications that do not allow user-controlled values to reach those options are not described as vulnerable.
What does an attacker need to exploit it?
An attacker needs control over data supplied to the prefix, postfix, or dir options. They can use traversal sequences such as ../ or path separators to make tmp create files or directories outside the intended temporary base directory.
What is the impact of successful exploitation?
Files or directories can be created at attacker-controlled locations outside the configured temporary directory. Creation occurs with the privileges of the running process.
What can be done if upgrading is not immediately possible?
Ensure untrusted input cannot flow into the prefix, postfix, or dir options, and sanitize those values to prevent traversal sequences and path separators. Upgrade tmp to version 0.2.6 when possible.