tmp npm Package Path Traversal Vulnerability (CVE-2024-44705) Advisory

Vulnerability Overview Vulnerability Name: Path Traversal via unsanitized prefix/postfix enables directory escape in tmp Vulnerability Description: A path traversal vulnerability exists in the npm package, allowing escape from the intended temporary directory if the user-supplied , , or options are not properly sanitized. By embedding traversal sequences (such as ) or path separators into these parameters, an attacker can create files in attacker-controlled locations outside the configured temporary base directory, executed with the privileges of the running process. Affected Versions: All versions with vulnerable path construction logic (potentially all current versions) Fixed Version: 0.2.6 CVE ID: CVE-2024-44705 CWE ID: CWE-22 Severity: High Impact Scope Arbitrary File Creation: Files can be created outside the expected temporary directory. Attacker-Controlled File Placement: Attackers can dictate where files are placed. Potential Overwriting of Existing Files: Depending on the creation flags, existing files may be overwritten. Cross-Platform Exploitation: The vulnerability is effective on Windows, Unix, and mixed-path systems. Attack Scenarios: 1. Web Application Configuration Poisoning: A user uploads a file with a malicious . creates a "temporary" file in the application configuration directory, which is then loaded as a malicious configuration upon the next application restart. 2. Cache Poisoning: An application uses to cache user content. An attacker escapes to the cache directories of different users/tenants, poisoning the cache to serve malicious content to other users. 3. Build Pipeline Compromise: A CI/CD system uses to handle user pull requests. A malicious allows escape to the build output directory, leading to compromised build artifacts being deployed to the production environment. 4. Container Escape Attempts: Containerized applications use with user input. An attacker attempts to escape container temporary restrictions, creating files in host-mounted volumes or sensitive container areas. 5. Multi-Tenant Service Bypass: SaaS platforms use separate directories to isolate tenants. Tenant A escapes into Tenant B's area, enabling cross-tenant data access and potential privilege escalation. Business Impact: Data Integrity: Unauthorized file creation may corrupt application state. Service Disruption: Files placed in incorrect locations may break application functionality. Security Bypass: Escaping temporary isolation boundaries. Compliance Violations: Sensitive data files placed in uncontrolled locations. Remediation Input Validation and Sanitization: 1. Sanitize : 2. Validate Parameter: 3. Post-Construction Path Validation: Secure Implementation Pattern: Workarounds: Input Sanitization: Sanitize user input before passing it to . Path Validation: Verify that generated paths remain within the expected base directory. Restricted Usage: Use only known-safe literals; avoid using user-controlled values. Code Review Patterns: Search for dangerous usage: and . Runtime Monitoring: Monitor for file creation outside the expected temporary area. Static Analysis: Scan for usage involving user-controlled input. Identify parameters passed to functions without sanitization. Review file creation patterns within temporary directories. Runtime Detection: Monitor file creation operations. Log and alert on anomalous path operations. Implement a file creation allowlist.

Goal Reached Thanks to every supporter — we hit 100%!

tmp npm Package Path Traversal Vulnerability (CVE-2024-44705) Advisory

More from this source