NodeJS/cli/0.4.3

Duplicate Advisory: Node CLI Allows Arbitrary File Overwrite

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6cpc-mj5c-m9rq. This link is maintained to preserve external references.

Original Description

An issue exists in node-cli 0.1.0 through 0.11.3 due to predictable temporary file names in lockfile and logfile, which allows an attacker to overwrite files.

Arbitrary File Write in cli

Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to.

Proof of Concept

By creating Symbolic Links at the following locations, the target of the link can be written to. lock_file = '/tmp/' + cli.app + '.pid', log_file = '/tmp/' + cli.app + '.log';

Recommendation

Update to version 1.0.0 or later.

Arbitrary File Write

lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';

The package node-cli insecurely uses the lockfile and logfile. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.