npm Token Leak Affecting npm Open this link in a new tab package, versions [,2.15.0] [3,3.8.2)


0.0
medium
  • Attack Complexity

    High

  • User Interaction

    Required

  • Confidentiality

    High

  • Integrity

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-DOTNET-NPM-60200

  • published

    20 Apr 2016

  • disclosed

    20 Apr 2016

  • credit

    Mitar, Will White & the team at Mapbox, Max Motovilov, James Taylor

Introduced: 20 Apr 2016

CWE-200 Open this link in a new tab

How to fix?

  1. Upgrade npm to ">= 3.8.3 || >= 2.15.1"
  2. Invalidate your current npm bearer tokens

Overview

This vulnerability could cause the unintentional leakage of bearer tokens. A design flaw in npm's registry allows an attacker to set up an HTTP server that could collect authentication information, and then use this authentication information to impersonate the users whose tokens they collected. The attacker could do anything the compromised users could do, including publishing new versions of packages.

Details

The primary npm registry has, since late 2014, used HTTP bearer tokens to authenticate requests from the npm command-line interface. Due to a design flaw in the CLI, these bearer tokens were sent with every request made by logged-in users, regardless of the destination of the request. (The bearers only should have been included for requests made against a registry or registries used for the current install.)

This flaw allows an attacker to set up an HTTP server that could collect authentication information. They could then use this information to impersonate the users whose tokens they collected. This impersonation would allow them to do anything the compromised users could do, including publishing new versions of packages.

With the fixes npm have released, the CLI will only send bearer tokens with requests made against a registry. npm’s CLI team believe that the fix won’t break any existing registry setups. However, it’s possible the change will be breaking in some cases, due to the large number of registry software suites used.