CVE-2023-37478_npm_vs_pnpm

pnpm vs npm 익스플로잇 이 저장소는 tarball 설치 시 npm과 pnpm 간의 차이가 어떻게 악용될 수 있는지 보여줍니다. 이 익스플로잇은 CVE-2023-37478로 기록되어 있습니다. 여기서 제작된 자바스크립트 패키지는 사용자에게 친절한 메시지를 출력한다고 주장합니다. npm으로 설치하면 실제로 그렇습니다. 하지만 동일한 패키지를 pnpm으로 설치하면 불쾌한 메시지가 출력됩니다. 이것이 더 악의적으로 악용될 수 있는 방법을 상상해 볼 수 있습니다. 이 익스플로잇과 함께 동작하는 오래된 취약 버전의 pnpm을...

CVE-2023-37478-Demo

CVE-2023-37478-Demo...

SUSE CVE-2023-37478

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/macos-x64 (>=7.0.0, <=7.33.3)

@pnpm/macos-x64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/linux-x64 (>=8.0.0, <=8.6.7)

@pnpm/linux-x64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/win-x64 (>=8.0.0, <=8.6.7)

@pnpm/win-x64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/win-x64 (>=7.0.0, <=7.33.3)

@pnpm/win-x64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

ynpm-tool (>=4.0.5-pnpm.15, <=5.5.11) potentially affected by CVE-2023-37478 via pnpm (>=7.2.1, <=7.5.1)

pnpm NPM version =7.2.1, =4.0.5-pnpm.15, =5.5.11 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/linux-x64 (>=7.0.0, <=7.33.3)

@pnpm/linux-x64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/linux-arm64 (>=8.0.0, <=8.6.7)

@pnpm/linux-arm64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/linux-arm64 (>=7.0.0, <=7.33.3)

@pnpm/linux-arm64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/assert-project (>=0.0.0-20230605-20230605142810, <=2.3.28), @pnpm/assert-store (>=1.0.59, <=1.0.63) +41 more potentially affected by CVE-2023-37478 via @pnpm/cafs (>=7.0.0, <=7.0.4)

@pnpm/cafs NPM version =7.0.0, =0.0.0-20230605-20230605142810, =1.0.59, =2.0.0, =18.0.0, =0.0.0-20230605-20230605142810, =4.0.0, =12.0.0, =7.0.0, =6.0.0, =0.0.0-20230605-20230605142810, =0.0.0-20230605-20230605142810, =0.0.0-20230605-20230605142810, =0.0.0-20230605-20230605142810,...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/macos-arm64 (>=8.0.0, <=8.6.7)

@pnpm/macos-arm64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/macos-arm64 (>=7.0.0, <=7.33.3)

@pnpm/macos-arm64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

CVE-2023-37478

CVE-2023-37478 affects pnpm, where tarball parsing can cause a malicious package to be installed via pnpm even if it appears safe on npm or the registry. The issue stems from how pnpm parses tar archives and can lead to replacement of a safe package with a malicious one during installation. The v...

CVE-2023-37478

creationtimestamp| type| source ---|---|--- 2023-08-01 09:12:44+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-5r98-f33j-g8h7 2023-08-01 16:38:23+00:00| seen| https://t.me/cibsecurity/67502 2023-10-25 22:39:55+00:00| published-proof-of-concept|...