The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
| Link | Tags |
|---|---|
| https://cwe.mitre.org/data/definitions/377.html | third party advisory |
| https://www.owasp.org/index.php/Insecure_Temporary_File | third party advisory |
| https://github.com/gvarsanyi/sync-exec/issues/17 | issue tracking third party advisory |
| https://nodesecurity.io/advisories/310 | third party advisory |