CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1983 vulnerabilities reference this CWE, most recent first.
GHSA-2CWR-F5HX-GG3W
Vulnerability from github – Published: 2026-03-19 03:30 – Updated: 2026-03-19 16:26Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cfvj-7rx7-fc7c. This link is maintained to preserve external references.
Original Description
OpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2026.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-19T16:26:19Z",
"nvd_published_at": "2026-03-19T02:16:03Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-cfvj-7rx7-fc7c. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.3.2 contain a vulnerability in the stageSandboxMedia function in which it fails to validate destination symlinks during media staging, allowing writes to follow symlinks outside the sandbox workspace. Attackers can exploit this by placing symlinks in the media/inbound directory to overwrite arbitrary files on the host system outside sandbox boundaries.",
"id": "GHSA-2cwr-f5hx-gg3w",
"modified": "2026-03-19T16:26:19Z",
"published": "2026-03-19T03:30:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31990"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/17ede52a4be3034f6ec4b883ac6b81ad0101558a"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-stagesandboxmedia-destination"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace",
"withdrawn": "2026-03-19T16:26:19Z"
}
GHSA-2F6X-V9QJ-8F54
Vulnerability from github – Published: 2022-05-17 04:37 – Updated: 2025-04-12 12:36The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/xml##### temporary file.
{
"affected": [],
"aliases": [
"CVE-2014-5260"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-08-16T04:39:00Z",
"severity": "MODERATE"
},
"details": "The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.",
"id": "GHSA-2f6x-v9qj-8f54",
"modified": "2025-04-12T12:36:38Z",
"published": "2022-05-17T04:37:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5260"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/756566"
},
{
"type": "WEB",
"url": "https://metacpan.org/diff/file?target=AMBS/XML-DT-0.64/\u0026source=AMBS/XML-DT-0.63"
},
{
"type": "WEB",
"url": "https://metacpan.org/source/AMBS/XML-DT-0.66/Changes"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/08/15/8"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2FC2-6R4J-P65H
Vulnerability from github – Published: 2022-05-14 01:08 – Updated: 2024-10-01 21:12(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "numpy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-1859"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-17T21:06:08Z",
"nvd_published_at": "2018-01-08T19:29:00Z",
"severity": "HIGH"
},
"details": "(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.",
"id": "GHSA-2fc2-6r4j-p65h",
"modified": "2024-10-01T21:12:23Z",
"published": "2022-05-14T01:08:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1859"
},
{
"type": "WEB",
"url": "https://github.com/numpy/numpy/pull/4262"
},
{
"type": "WEB",
"url": "https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062009"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91317"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-2fc2-6r4j-p65h"
},
{
"type": "PACKAGE",
"url": "https://github.com/numpy/numpy"
},
{
"type": "WEB",
"url": "https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/numpy/PYSEC-2018-34.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228165750/http://www.securityfocus.com/bid/65440"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/02/08/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Numpy arbitrary file write via symlink attack"
}
GHSA-2FFP-P9MJ-92CF
Vulnerability from github – Published: 2022-05-24 17:10 – Updated: 2025-10-22 00:31An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
{
"affected": [],
"aliases": [
"CVE-2020-0787"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-12T16:15:00Z",
"severity": "HIGH"
},
"details": "An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka \u0027Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability\u0027.",
"id": "GHSA-2ffp-p9mj-92cf",
"modified": "2025-10-22T00:31:51Z",
"published": "2022-05-24T17:10:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0787"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0787"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0787"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/158056/Background-Intelligent-Transfer-Service-Privilege-Escalation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2G5J-5X95-R6HR
Vulnerability from github – Published: 2023-02-06 23:16 – Updated: 2023-02-06 23:16HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/go-slug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-29529"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-06T23:16:16Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.",
"id": "GHSA-2g5j-5x95-r6hr",
"modified": "2023-02-06T23:16:16Z",
"published": "2023-02-06T23:16:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29529"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/go-slug/pull/12"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/go-slug/commit/28cafc59c8da6126a3ae94dfa84181df4073454f"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/go-slug/commit/764785bc4cbb9e600ad1cf1a6bd21b535c182983"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/go-slug"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/go-slug/releases/tag/v0.5.0"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2021-0094"
},
{
"type": "ADVISORY",
"url": "https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Unsafe tar unpacking in HashiCorp go-slug"
}
GHSA-2GPQ-3P2H-4848
Vulnerability from github – Published: 2025-06-06 21:30 – Updated: 2025-06-06 21:302BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of 2BrightSparks SyncBackFree. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. User interaction on the part of an administrator is also required.
The specific flaw exists within the Mirror functionality. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26962.
{
"affected": [],
"aliases": [
"CVE-2025-5474"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T19:15:27Z",
"severity": "HIGH"
},
"details": "2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of 2BrightSparks SyncBackFree. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. User interaction on the part of an administrator is also required.\n\nThe specific flaw exists within the Mirror functionality. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26962.",
"id": "GHSA-2gpq-3p2h-4848",
"modified": "2025-06-06T21:30:28Z",
"published": "2025-06-06T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5474"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-322"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2GV2-H7Q5-C548
Vulnerability from github – Published: 2022-05-17 02:18 – Updated: 2022-05-17 02:18bluetooth.rc in p3nfs 5.19 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/blue.log temporary file.
{
"affected": [],
"aliases": [
"CVE-2008-5154"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-18T16:00:00Z",
"severity": "MODERATE"
},
"details": "bluetooth.rc in p3nfs 5.19 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/blue.log temporary file.",
"id": "GHSA-2gv2-h7q5-c548",
"modified": "2022-05-17T02:18:02Z",
"published": "2022-05-17T02:18:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5154"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46707"
},
{
"type": "WEB",
"url": "http://lists.debian.org/debian-devel/2008/08/msg00347.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32818"
},
{
"type": "WEB",
"url": "http://uvw.ru/report.sid.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32373"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2GVW-95CM-FFM9
Vulnerability from github – Published: 2022-05-17 03:30 – Updated: 2022-05-17 03:30provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock.
{
"affected": [],
"aliases": [
"CVE-2015-3436"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-06-09T14:59:00Z",
"severity": "MODERATE"
},
"details": "provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock.",
"id": "GHSA-2gvw-95cm-ffm9",
"modified": "2022-05-17T03:30:00Z",
"published": "2022-05-17T03:30:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3436"
},
{
"type": "WEB",
"url": "https://jira.zarafa.com/browse/ZCP-13282"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159455.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159497.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/75104"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2H3H-Q99F-3FHC
Vulnerability from github – Published: 2021-08-31 16:04 – Updated: 2022-08-15 20:08Impact
Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution
@npmcli/arborist, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.
This is, in part, accomplished by resolving dependency specifiers defined in package.json manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies.
When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the node_modules hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as file:/some/path, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem.
For example, a package pwn-a could define a dependency in their package.json file such as "foo": "file:/some/path". Another package, pwn-b could define a dependency such as FOO: "file:foo.tgz". On case-insensitive file systems, if pwn-a was installed, and then pwn-b was installed afterwards, the contents of foo.tgz would be written to /some/path, and any existing contents of /some/path would be removed.
Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected.
Patches
2.8.2 (included in npm v7.20.7 and above)
Fix and Caveats
There are two parts to the fix:
- Immediately prior to extraction, if the target folder is not a directory, it is moved aside. (If the installation fails, filesystem entries moved aside in this manner are moved back as part of the rollback process.)
- The
childrenmap that represents child nodes in the tree is replaced with a case-insensitive map object, such thatnode.children.get('foo')andnode.children.get('FOO')will return the same object, enabling Arborist to detect and handle this class of tree collision.
This second item imposes a caveat on case sensitive filesystems where two packages with names which differ only in case may already exist at the same level in the tree, causing unpredictable behavior in this rare edge case. Note that in such cases, the package-lock.json already creates a situation which is hazardous to use on case-sensitive filesystems, and will likely lead to other problems.
If affected by this caveat, please run npm update to rebuild your tree and generate a new package-lock.json file.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@npmcli/arborist"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-39134"
],
"database_specific": {
"cwe_ids": [
"CWE-178",
"CWE-59",
"CWE-61"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-31T16:02:46Z",
"nvd_published_at": "2021-08-31T17:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nArbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution\n\n`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.\n\nThis is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies.\n\nWhen multiple dependencies differ only in the case of their name, Arborist\u0027s internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem.\n\nFor example, a package `pwn-a` could define a dependency in their `package.json` file such as `\"foo\": \"file:/some/path\"`. Another package, `pwn-b` could define a dependency such as `FOO: \"file:foo.tgz\"`. On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed.\n\nAnyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected.\n\n### Patches\n\n2.8.2 (included in npm v7.20.7 and above)\n\n### Fix and Caveats\n\nThere are two parts to the fix:\n\n1. Immediately prior to extraction, if the target folder is not a directory, it is moved aside. (If the installation fails, filesystem entries moved aside in this manner are moved back as part of the rollback process.)\n2. The `children` map that represents child nodes in the tree is replaced with a case-insensitive map object, such that `node.children.get(\u0027foo\u0027)` and `node.children.get(\u0027FOO\u0027)` will return the same object, enabling Arborist to detect and handle this class of tree collision.\n\nThis second item imposes a caveat on case _sensitive_ filesystems where two packages with names which differ only in case may already exist at the same level in the tree, causing unpredictable behavior in this rare edge case. Note that in such cases, the `package-lock.json` already creates a situation which is hazardous to use on case-sensitive filesystems, and will likely lead to other problems.\n\nIf affected by this caveat, please run `npm update` to rebuild your tree and generate a new `package-lock.json` file.",
"id": "GHSA-2h3h-q99f-3fhc",
"modified": "2022-08-15T20:08:31Z",
"published": "2021-08-31T16:04:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39134"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
},
{
"type": "PACKAGE",
"url": "https://github.com/npm/arborist"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/@npmcli/arborist"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "@npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following"
}
GHSA-2HPJ-V4F4-7G4J
Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2024-12-06 15:31dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.
{
"affected": [],
"aliases": [
"CVE-2019-12749"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-11T17:29:00Z",
"severity": "HIGH"
},
"details": "dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.",
"id": "GHSA-2hpj-v4f4-7g4j",
"modified": "2024-12-06T15:31:17Z",
"published": "2022-05-24T16:47:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12749"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1726"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2868"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2870"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3707"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00005.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2CQF37O73VH2JDVX2ILX2KD2KLXLQOU"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2CQF37O73VH2JDVX2ILX2KD2KLXLQOU"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Jun/16"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201909-08"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241206-0010"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4015-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4015-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4462"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2019/06/11/2"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00059.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00092.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00026.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/06/11/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108751"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.