Threats Tagged 'cwe-59'

## Summary The Nx **self-hosted HTTP remote cache** extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path (MITM) — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache. ## Affected Packages > [!IMPORTANT] > **Nx's default local cache and Nx Cloud are NOT affected.** The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (`NX_SELF_HOSTED_REMOTE_CACHE_SERVER`, `@nx/s3-cache`, etc.) are affected. Two self-hosted cache surfaces are affected: 1. **The built-in HTTP remote cache** (`NX_SELF_HOSTED_REMOTE_CACHE_SERVER`, in `nx`) — **fixed** in the patched release. 2. **The self-hosted cache packages** — `@nx/s3-cache`, `@nx/gcs-cache`, `@nx/azure-cache`, `@nx/shared-fs-cache` (and their `@nx/powerpack-*` predecessors) — the same flaw in their own extractor. **Deprecated** (CVE-2025-36852) and not patched; migrate off (see Remediation). The shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched `nx` release. ## Remediation **Upgrade to Nx `22.7.7` or `23.0.2` (or later).** The patched extractor is a drop-in — no configuration change is required. ### If you use the S3, GCS, Azure, or shared-filesystem cache packages `@nx/s3-cache`, `@nx/gcs-cache`, `@nx/azure-cache`, and `@nx/shared-fs-cache` (and their `@nx/powerpack-*` predecessors) are separately versioned packages and are **already deprecated** (see CVE-2025-36852). Upgrading `nx` hardens the shared restore step, but it does not fully secure these packages. The remediation for them is to **migrate off** — to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache — per the deprecation guidance: https://nx.dev/docs/reference/deprecated/self-hosted-cache-packages ## Details When Nx retrieves an artifact from the self-hosted HTTP remote cache, it downloads a gzipped tar archive and extracts it. The extractor joined each untrusted tar entry name directly onto the output directory and unpacked it with `tar`'s **unguarded** `Entry::unpack()`, which performs no containment check: ```rust // vulnerable let path_on_disk = output_dir.join(entry_path); // entry_path is attacker-controlled fs::create_dir_all(path_on_disk.parent()…)?; entry.unpack(&path_on_disk)?; ``` In addition, restore now copies **only** the declared task outputs (never the whole cache directory), confined to the workspace root; parent directories are realized as real directories so a write can never traverse a symlink; declared outputs that resolve outside the workspace are rejected; and the malformed-input cases return errors instead of panicking. ## References - Fix: https://github.com/nrwl/nx/pull/36116 (merged) - TLS-verification warning follow-up: https://github.com/nrwl/nx/pull/36132 (merged) - Vulnerable extractor introduced in Nx 20.8.0: https://github.com/nrwl/nx/pull/30593 ## Credits - **Lidor B.**, Novee Security — Reporter - **Assaf Levkovich**, Novee Security — Reporter

A vulnerability exists in mf-yang openclaw-cn up to version 0.2.1 in the assertNoSymlinkEscape function of the apply_patch tool. This flaw allows remote attackers to manipulate link following, potentially leading to unauthorized actions. The vulnerability is identified as CWE-59 (link following). An exploit is publicly available, but no vendor response or patch has been issued yet.

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity.

Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

CVE-2026-67433 is a medium severity vulnerability in Linuxfabrik monitoring-plugins version 6.0.0. It involves improper link resolution before file access, where a local user controlling the plugin account can create a symbolic link in a predictable /tmp path. This symlink is followed by sqlite3.connect() during a root-run check, potentially leading to unauthorized file access or modification.

A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing: • a symlink entry named ss pointing to a target file, and • a regular file named ß containing attacker controlled data, will cause the second write to follow the symlink and overwrite the target file.

CVE-2026-12503 is a critical vulnerability in Loytec LIP-ME20xC devices running L-INX up to version 8.4.16 on LINX-A64. It involves improper link resolution in the /usr/bin/larm_starter component, allowing an authenticated attacker with larmapp group privileges to exploit a symlink attack on /etc/lighttpd/ssl/server.pem. This attack can make /etc/passwd writable by the larmapp group, potentially leading to root privilege escalation.

Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file with insecure permissions and open flags. The file is created with mode 0666 (resulting in 0644 after umask), making it world-readable. The open call lacks O_EXCL and O_NOFOLLOW flags, allowing a local attacker to exploit symlink following and pre-creation race conditions in shared directories like /tmp or /dev/shm. This can lead to unauthorized local read access to IPC payloads.

Data::SpatialHash::Shared versions before 0.02 for Perl create a memory-mapped backing file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication payloads and potentially manipulate the file open operation by pre-creating files or symlinks at the target path.

Data::Intern::Shared versions before 0.02 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without secure flags, allowing local users to read sensitive IPC data or exploit race conditions via symlink attacks. The file is created with mode 0666 but typically results in 0644 permissions due to umask, and lacks O_EXCL and O_NOFOLLOW flags, enabling pre-creation races and symlink following in shared directories like /tmp or /dev/shm.