file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write
    in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes
    which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write
    access to both source and destination directories as the lower-privileged user can create a symlink to the
    GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root. (CVE-2022-1537)

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3383 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3383-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     April 05, 2023                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : grunt     Version        : 1.0.1-8+deb10u2     CVE ID         : CVE-2022-1537

    It was discovered that there was a potential local privilege     escalation in GruntJS, a multipurpose task runner and build system     tool.

    file.copy operations in GruntJS were vulnerable to a TOCTOU     (time-of-check vs. time-of-use) race condition that could have led     to arbitrary file writes in GitHub repositories. This could have then     led to local privilege escalation if a lower-privileged user had     write access to both source and destination directories, as the     lower-privileged user could have created a symlink to the GruntJS     user's ~/.bashrc configuration file (etc).

    For Debian 10 buster, this problem has been fixed in version     1.0.1-8+deb10u2.

    We recommend that you upgrade your grunt packages.

    For the detailed security status of grunt please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/grunt

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5847-1 advisory.

    It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could     possibly use this issue to execute arbitrary code. (CVE-2020-7729)

    It was discovered that Grunt was not properly handling symbolic links when performing file copy     operations. An attacker could possibly use this issue to expose sensitive information or execute arbitrary     code. (CVE-2022-0436)

    It was discovered that there was a race condition in the Grunt file copy function, which could lead to an     arbitrary file write. An attacker could possibly use this issue to perform a local privilege escalation     attack or to execute arbitrary code. (CVE-2022-1537)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
418798	SCA: security update for grunt (GHSA-rm36-94g8-835r)	Tenable Cloud Security	SCA Checks	high
418798	SCA: security update for grunt (GHSA-rm36-94g8-835r)	Tenable Self-Hosted Container Security	SCA Checks	high
173923	Debian dla-3383 : grunt - security update	Nessus	Debian Local Security Checks	high
171105	Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : Grunt vulnerabilities (USN-5847-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2022-1537

high

Tenable Plugins

high

high

high

high