CVE-2021-43616

Name
CVE-2021-43616
Description
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://docs.npmjs.com/cli/v7/commands/npm-ci
MISC https://github.com/npm/cli/issues/2701
MISC https://github.com/icatalina/CVE-2021-43616
Exploit https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0
Third Party Advisory https://security.netapp.com/advisory/ntap-20211210-0002/
Patch https://github.com/npm/cli/commit/457e0ae61bbc55846f5af44afa4066921923490f
Mailing List https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:* npm >= 7.0.0 <= 7.24.2
cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:* npm >= 8.0.0 <= 8.1.3

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
npm 3.14-main 7.17.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
npm 3.15-main 8.1.3-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable