CVE-2021-43616

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.

CVSS v3.0 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://docs.npmjs.com/cli/v7/commands/npm-ci	Vendor Advisory
https://github.com/npm/cli/issues/2701	Exploit Issue Tracking Third Party Advisory
https://github.com/icatalina/CVE-2021-43616	Third Party Advisory
https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0	Exploit Third Party Advisory
https://security.netapp.com/advisory/ntap-20211210-0002/	Third Party Advisory
https://github.com/npm/cli/commit/457e0ae61bbc55846f5af44afa4066921923490f
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:npmjs:npm::::::::
	cpe:2.3:a:npmjs:npm::::::::

Configuration 2 (hide)

cpe:2.3:a:netapp:next_generation_application_programming_interface:-:*:*:*:*:*:*:*

Information

Published : 2021-11-13 18:15

Updated : 2022-02-19 03:15

NVD link : CVE-2021-43616

Mitre link : CVE-2021-43616

JSON object : View

Products Affected

npmjs

npm

netapp

next_generation_application_programming_interface

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://docs.npmjs.com/cli/v7/commands/npm-ci", "name": "https://docs.npmjs.com/cli/v7/commands/npm-ci", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://github.com/npm/cli/issues/2701", "name": "https://github.com/npm/cli/issues/2701", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/icatalina/CVE-2021-43616", "name": "https://github.com/icatalina/CVE-2021-43616", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0", "name": "https://medium.com/cider-sec/this-time-we-were-lucky-85c0dcac94a0", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://security.netapp.com/advisory/ntap-20211210-0002/", "name": "https://security.netapp.com/advisory/ntap-20211210-0002/", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/npm/cli/commit/457e0ae61bbc55846f5af44afa4066921923490f", "name": "https://github.com/npm/cli/commit/457e0ae61bbc55846f5af44afa4066921923490f", "tags": [], "refsource": "CONFIRM"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NXNVFKOF5ZYH5NIRWHKN6O6UBCHDV6FE/", "name": "FEDORA-2022-97b214b298", "tags": [], "refsource": "FEDORA"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-345"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-43616", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2021-11-13T18:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.24.2", "versionStartIncluding": "7.0.0"}, {"cpe23Uri": "cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "8.1.3", "versionStartIncluding": "8.0.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:netapp:next_generation_application_programming_interface:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-02-19T03:15Z"}