anyjs-client: Race Condition in Soft Link Follow Leads to Arbitrary File Read

Vulnerability Summary: Resumable Download Index Store Created as World-Readable and Following Symbolic Links Vulnerability Overview creates a download index directory with a predictable path in a shared directory, and this directory is set to be world-readable. Attackers can exploit this by creating symbolic links pointing to arbitrary files, inducing the client to read sensitive files (such as files), thereby stealing data. This vulnerability affects all clients using when they connect to a server controlled by an attacker, causing them to read the target files of forged symbolic links. > Note: This vulnerability is only triggered when using without specifying a custom directory. --- Scope of Impact Affected Versions: - ≥ 3.1 and ≤ 3.0.11 - ≥ 2.4 and ≤ 2.16.0 CVSS Score: 8.0 / 10 (High) CWE ID: CWE-284 (Improper Access Control) Weakness Types: - CWE-284 - CWE-359 (Symbolic Link Race Condition) - CWE-379 (Symbolic Link Race Condition) --- Remediation Fixed Versions: - 3.1.12 and later (3.x series) - 2.16.1 and later (2.x series) Fix Details: - The download index directory is now created with owner-only permissions. - Permissions are set to owner-only at the time of directory creation to prevent subsequent modification. - The symbolic link following issue has been resolved. --- Known Limitations If directory permissions are set to , the issue cannot be fixed (due to lack of owner-only permissions). Attackers can still induce clients to read incorrect files (e.g., ) by forging symbolic links, provided directory permissions are not properly restricted. --- Mitigation (Workarounds) Avoid sharing temporary directories with unauthorized users. Alternatively, place the temporary directory within a private directory, ensuring permissions are set to or stricter. --- Detailed Fix Explanation In the constructor: 1. A directory (including symbolic links) is created. 2. The directory is created using . 3. Permissions are subsequently set to . However, a race condition window exists: between the call and the call, the directory may be exploited by an attacker. > Note: Versions 3.1.12 and later were fixed via a separate PR (GitHub PR #321), which also addressed an issue where Digit challengers could not read the directory. --- POC / Exploitation Description (No Direct Code Block, but Clearly Described) The page does not provide a complete POC code block but describes the exploitation method: Example Scenario: The client expects to read . The attacker creates a symbolic link: . The client reads this file → leaks the contents of . --- Additional Information Reporter: hypergeometric Report Date: August 10, 2024 Project: anyjs-client Security Tags: Security and quality

Goal Reached Thanks to every supporter — we hit 100%!

anyjs-client: Race Condition in Soft Link Follow Leads to Arbitrary File Read

More from this source