CVE-2021-39135

一、漏洞信息
 漏洞编号：[CVE-2021-39135](https://nvd.nist.gov/vuln/detail/CVE-2021-39135)
 漏洞归属组件：[nodejs](https://gitee.com/src-openeuler/nodejs)
 漏洞归属的版本：12.18.4
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
 漏洞简述：
  `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project s `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.
 漏洞公开时间：2021-09-01 01:15
 漏洞创建时间：2022-03-17 17:33:09
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-39135
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
      `@npmcli/arborist`，计算依赖树并管理 npm 命令行界面的 node_modules 文件夹层次结构的库，旨在保证满足包依赖契约，并且包内容的提取将始终执行到预期的文件夹。这是通过将包内容提取到项目的“node_modules”文件夹中来完成的。如果根项目的 `node_modules` 文件夹或其任何依赖项以某种方式被符号链接替换，它可能允许 Arborist 将包依赖项写入文件系统上的任意位置。请注意，包工件内容中包含的符号链接被过滤掉，因此必须采用另一种创建“node_modules”符号链接的方法。 1. `preinstall` 脚本可以用符号链接替换 `node_modules`。 （这可以通过使用 `--ignore-scripts` 来防止。） 2. 攻击者可以为目标提供一个 git 存储库，指示他们在根目录中运行 `npm install --ignore-scripts`。这可能会成功，因为 `npm install --ignore-scripts` 通常无法在项目目录之外进行更改，因此它可能被认为是安全的。这是在 npm v7.20.7 及更高版本中包含的 @npmcli/arborist 2.8.2 中修补的。有关包括解决方法在内的更多信息，请参阅参考的 GHSA-gmw6-94gg-2rc2。  
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(12.22.11):受影响
2.openEuler-20.03-LTS-SP1(12.22.11):受影响
3.openEuler-20.03-LTS-SP2(12.22.11):受影响
4.openEuler-20.03-LTS-SP3(12.22.11):受影响
5.openEuler-21.09(12.22.11):受影响
6.openEuler-22.03-LTS(12.22.11):受影响
7.openEuler-22.03-LTS-Next(12.22.11):受影响

修复是否涉及abi变化(是/否)：
  1.master(12.22.11):是
2.openEuler-20.03-LTS-SP1(12.22.11):是
3.openEuler-20.03-LTS-SP2(12.22.11):是
4.openEuler-20.03-LTS-SP3(12.22.11):是
5.openEuler-21.09(12.22.11):是
6.openEuler-22.03-LTS(12.22.11):是
7.openEuler-22.03-LTS-Next(12.22.11):是

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2022-1620

src-openEuler/nodejs
关闭

内容风险标识

评论 (8)

src-openEuler/nodejs关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-39135

评论 (8)

搜索帮助

src-openEuler/nodejs
关闭