Medium, CVSS 6.2npmAmendedPublished
webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle
CVE-2024-43373 · GHSA-ccqh-278p-xq6w
- Affected
- npm webcrack <= 2.14.0
- Fixed in
- 2.14.1· Vendor fix available
- Issue
- An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using the unpack bundles feature in conjunction with the saving feature. If a module name includes a path traversal sequence with Windows path separators, an attacker can exploit this to overwrite files on the host system. Details Source: packages/webcrack/src/unpack/bundle.ts#L79 In this code, the application explicitly relies on the POSIX version of path utilities (dirname, join, normalize) from Node.js. However, the vulnerability arises because the POSIX version of the normalize function does not recognize \ as a path separator. As a result, on Windows systems, the path traversal check fails, allowing an attacker to write files to unintended locations. PoC The following proof of concept demonstrates how this vulnerability can be exploited to overwrite and hijack the debug module in Node.js:…
Recommended action: Upgrade to 2.14.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.