--- title: "CX-2022-5016" date: "2022-09-12T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5016/" --- # CX-2022-5016 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) CVE-2022-0436 **Published:** Sep 12, 2022 CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 5.5 Medium Severity javascript node nodejs npm path traversal @ @haxatron Reported by Checkmarx Zero Details Overview ## Summary Path Traversal in gruntjs/grunt. ## Product gruntjs/grunt prior to 1.5.2. ## Impact If a local attacker has write access to the source directory and read access to the directory containing the destination directory, they are able to abuse the file.copy operation to expose restricted files such as /etc/shadow which contains all the hashed passwords of users on the Linux system, they can they escalate their privileges by cracking the password or even SSH private keys. If an attacker has write access to the source and destination directories, they are able to abuse the file.copy operation to overwrite restricted files such as /etc/shadow with their own shadow file and replace the root password with their own or even sign their own pair of SSH keys and replace the SSH public key with their own, guaranteeing them to escalate their privileges. ## Steps to reproduce Scenario 1 – Restricted File Read If a local attacker has write access to the source directory of file.copy, they can create a symlink to a restricted file. When the source directory is then copied from, either by the root user or a GruntJS task / cronjob running as root, the symlink is resolved and the contents of the restricted file will be copied to the destination directory with default umask permissions rw-r–r–, the directory will also be copied with permissions drwxr-xr-x. allowing them to read the restricted file. Proof of Concept: As a lower-privileged user: ```mkdir ln -s /etc/shadow src/shadow ``` As root execute the following PoC: ```grunt grunt.file.copy("src", "dest") ``` Scenario 2 – Restricted File Write If an attacker has write access to both the source directory and the destination directory (if it has already been created) of file.copy, they can create a symlink to a restricted file in the destination directory and a file of the same name in the source directory. When the destination directory is then copied to, either by the root user or a cronjob running as root, the symlink is resolved to a restricted file and the file of the same name in source is copied to the resolved file path of the symlink in destination Proof of Concept: As a lower-privileged user: ```mkdir mkdir dest ln -s /etc/shadow2 dest/shadow2 echo "" > src/shadow2 ``` As root execute the following PoC: ```grunt grunt.file.copy("src", "dest") ``` ### Expected result: Scenario 1 – Restricted File Read The lower privileged user can read the contents of the /etc/shadow file in the dest directory `cat dest/shadow` Scenario 2 – Restricted File Write The /etc/shadow2 file is overwritten `` ## Remediation Update gruntjs/grunt to version 1.5.2. ## Credit This issue was reported by @haxatron through huntr.dev. ## Resources 1. [Commit](https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665) 2. [Commit](https://github.com/gruntjs/grunt/commit/b0ec6e12426fc8d5720dee1702f6a67455c5986c) 3. [Disclosure](https://huntr.dev/bounties/f55315e9-9f6d-4dbb-8c40-bae50c1ae92b/) 0 Medium Severity CVSS v3.1 Score 5.5 CVSS v3.1 Vectors- Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None Advisory Timeline1. Disclosed Jan 26, 2022 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)