CVE-2023-37478
HIGHpnpm < 7.33.4 - Improper Access Control via Tarball Parsing
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2023-37478. PoCs published by TrevorGKann, li-minhao.
AI-analyzed exploit summary This PoC demonstrates CVE-2023-37478, exploiting a difference in how `npm` and `pnpm` handle tarball installations. The exploit leverages a maliciously crafted tarball with two versions of a package, where `pnpm` installs the older, malicious version due to its handling of tarball contents.
Description
pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. This issue has been patched in version(s) 7.33.4 and 8.6.8.
Exploits (2)
This PoC demonstrates CVE-2023-37478, exploiting a difference in how `npm` and `pnpm` handle tarball installations. The exploit leverages a maliciously crafted tarball with two versions of a package, where `pnpm` installs the older, malicious version due to its handling of tarball contents.
This repository demonstrates CVE-2023-37478, a vulnerability in a Tic-Tac-Toe game where the `calculateWinner` function in the bad version always returns 'O' as the winner, regardless of the actual game state. The PoC includes both vulnerable and patched versions for comparison.
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H