medium6.5
CVE-2017-16024
Tmp files readable by other users in sync-exec
Impact
Affected versions of `sync-exec` use files located in `/tmp/` to buffer command results before returning values. As `/tmp/` is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via `sync-exec` under a higher privilege user. ## Recommendation There is currently no direct patch for `sync-exec`, as the `child_process.execSync` function provided in Node.js v0.12.0 and later provides the same functionality natively. The best mitigation currently is to update to Node.js v0.12.0 or later, and migrate all uses of `sync-exec` to `child_process.execSync()`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | sync-exec | <= 0.6.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sync-Exec Project | Sync-Exec | through 0.6.2 |
| Nodejs | Node.Js | before 0.11.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://cwe.mitre.org/data/definitions/377.html
- https://github.com/gvarsanyi/sync-exec/issues/17
- https://nodesecurity.io/advisories/310
- https://www.owasp.org/index.php/Insecure_Temporary_File
- https://github.com/advisories/GHSA-38h8-x697-gh8q
- https://nvd.nist.gov/vuln/detail/CVE-2017-16024
- https://www.npmjs.com/advisories/310