CVE-2022-1537
published 2022-05-10CVE-2022-1537: file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3…
PriorityP336high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.30%
22.2th percentile
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | grunt | < grunt 1.5.3-1 (bookworm) | grunt 1.5.3-1 (bookworm) |
| gruntjs | grunt | < 1.5.3 | 1.5.3 |
| gruntjs | grunt | >= 0 < 1.3.0-1+deb11u2 | 1.3.0-1+deb11u2 |
| gruntjs | grunt | >= 0 < 1.5.3-1 | 1.5.3-1 |
| gruntjs | grunt | >= 0 < 1.5.3-1 | 1.5.3-1 |
| gruntjs | grunt | >= 0 < 1.5.3-1 | 1.5.3-1 |
| gruntjs | grunt | >= 0 < 1.0.1-8ubuntu0.1+esm1 | 1.0.1-8ubuntu0.1+esm1 |
| gruntjs | grunt | >= 0 < 1.0.4-2ubuntu0.1~esm1 | 1.0.4-2ubuntu0.1~esm1 |
| gruntjs | grunt | >= 0 < 1.4.1-2ubuntu0.1~esm1 | 1.4.1-2ubuntu0.1~esm1 |
| gruntjs | grunt | >= 0 < 1.5.3 | 1.5.3 |
| gruntjs | gruntjs_grunt | >= unspecified < 1.5.3 | 1.5.3 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.1HIGH
vendor_ubuntu7.1HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Grunt vulnerabilities
vendor_ubuntu·2023-02-07·CVSS 7.1
CVE-2020-7729 [HIGH] Grunt vulnerabilities
Title: Grunt vulnerabilities
Summary: Several security issues were fixed in Grunt.
It was discovered that Grunt was not properly loading YAML files before
parsing them. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2020-7729)
It was discovered that Grunt was not properly handling symbolic links
when performing file copy operations. An attacker could possibly use this
issue to expose sensitive information or execute arbitrary code.
(CVE-2022-0436)
It was discovered that there was a race condition in the Grunt file copy
function, which could lead to an arbitrary file write. An attacker could
possibly use this issue to perform a local privilege escalation attack or
to execute arbitrary code. (CVE-2022-1537)
Instructions: In general, a standard system update wi
Red Hat
gruntjs: race condition leading to arbitrary file write
vendor_redhat·2022-05-10·CVSS 7.0
CVE-2022-1537 [HIGH] CWE-367 gruntjs: race condition leading to arbitrary file write
gruntjs: race condition leading to arbitrary file write
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
A flaw was found in the GruntJS package during file.copy operations. This vulnerability is capable of arbitrary file writes, that can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to
Debian
CVE-2022-1537: grunt - file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leadin...
vendor_debian·2022·CVSS 7.0
CVE-2022-1537 [HIGH] CVE-2022-1537: grunt - file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leadin...
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
Scope: local
bookworm: resolved (fixed in 1.5.3-1)
bullseye: resolved (fixed in 1.3.0-1+deb11u2)
forky: resolved (fixed in 1.5.3-1)
sid: resolved (fixed in 1.5.3-1)
trixie: resolved (fixed in 1.5.3-1)
OSV
grunt vulnerabilities
osv·2023-02-07·CVSS 7.1
CVE-2020-7729 [HIGH] grunt vulnerabilities
grunt vulnerabilities
It was discovered that Grunt was not properly loading YAML files before
parsing them. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2020-7729)
It was discovered that Grunt was not properly handling symbolic links
when performing file copy operations. An attacker could possibly use this
issue to expose sensitive information or execute arbitrary code.
(CVE-2022-0436)
It was discovered that there was a race condition in the Grunt file copy
function, which could lead to an arbitrary file write. An attacker could
possibly use this issue to perform a local privilege escalation attack or
to execute arbitrary code. (CVE-2022-1537)
GHSA
Race Condition in Grunt
ghsa·2022-05-11
CVE-2022-1537 [HIGH] CWE-367 Race Condition in Grunt
Race Condition in Grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
OSV
Race Condition in Grunt
osv·2022-05-11
CVE-2022-1537 [HIGH] Race Condition in Grunt
Race Condition in Grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
OSV
CVE-2022-1537: file
osv·2022-05-10·CVSS 7.0
CVE-2022-1537 [HIGH] CVE-2022-1537: file
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
No detection rules found.
No public exploits indexed.
https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362baehttps://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4dhttps://lists.debian.org/debian-lts-announce/2023/04/msg00006.htmlhttps://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362baehttps://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4dhttps://lists.debian.org/debian-lts-announce/2023/04/msg00006.html
2022-05-10
Published